[ceciliaromao]

Description

• Rejects a wildcard home_domains match whose host has a label longer than 63 characters or is longer than 253 characters (the :port is not counted). The check lives in ClientDomainHelper.hasValidHostLabels, so SEP-10 and SEP-45 both get it. Exactly 63 and exactly 253 are still accepted. The exact-match branch is unchanged.
• Adds regression tests for report #4108627 at the three SEP-10 call sites of the matcher, using the reporter's fixture (*.wildcard.stellar.org) and strings: evil.com/x.wildcard.stellar.org and a.wildcard.stellar.org/evil are rejected, abc.def.wildcard.stellar.org and a.wildcard.stellar.org are accepted.
  • createChallenge (GET /auth)
  • validateChallenge (POST /auth, operation key name check)
  • validateChallengeTransactionHomeDomain

Context

• Report #4108627: SEP-10 signed a caller-chosen home_domain on a wildcard config because isDomainNameMatch expanded * to .*, so evil.com/x.wildcard.stellar.org matched *.wildcard.stellar.org.
• The fix for that claim (* limited to [A-Za-z0-9_.-], plus empty/hyphen-edged label rejection) is already in [ANCHOR-1400]: Validate the SEP-45 home domain with the shared matcher and restrict wildcard matching #2087 (ANCHOR-1400), which this branch is stacked on. This PR does not touch it.
• What was left: (1) only createChallenge had a test with a slash payload, and with another fixture; the POST /auth sites had none. (2) The assessment promised to reject a home_domain that is not a syntactically valid host, but a label over 63 characters or a host over 253 still matched under *.sdp.stellar.org, which no DNS host can have.

Testing

• ./gradlew test
• ./gradlew :core:test passes in full (1168 tests); 14 tests added in ClientDomainHelperTest (7), Sep10ServiceTest (6) and Sep45ServiceTest (1).
• Length limits are tested at the limit and at limit+1 (63/64 label, 253/254 host, with and without a :8080 port pattern).
• ./gradlew :core:spotlessCheck passes.
• Independent verification: all 15 spec checks pass at HEAD; 3 mutations (> to >= on each limit, dropping the port strip) and 15 more throwaway ones (including * back to .*) were all caught by the tests.

Documentation

N/A: internal validation change, no feature or public API change.

Known limitations

• Stacked on [ANCHOR-1400]: Validate the SEP-45 home domain with the shared matcher and restrict wildcard matching #2087 (fix/anchor-1400): retarget this PR to develop once [ANCHOR-1400]: Validate the SEP-45 home domain with the shared matcher and restrict wildcard matching #2087 merges.
• The length limits apply only to wildcard matches. A configured exact domain is compared by equality with no length rule, because that text comes from operator config, not from the request.
• _ is still accepted in wildcard labels (kept on purpose in ANCHOR-1400).
• The reporter's PoC is covered at unit level only; there is no integration test through the running /auth endpoints.