Validate trusted Admin hosts in auth flows - #1472

Description

This keeps authentication URL construction within Shopify's trusted Admin host boundaries.

• Validate decoded embedded-app hosts before constructing the URL, while preserving permissive Base64 decoding and byte-for-byte output for supported legacy and unified Admin URLs.
• Normalize and validate OAuth shop values before building the authorization route, including full URLs and current internal development hosts.
• Raise the existing ShopifyAPI::Errors::InvalidShopError for untrusted input.

How has this been tested?

• Added nine focused regression tests covering 19 representative scenarios; duplicate parser and ShopValidator cases were removed after targeted mutation review.
• Confirmed the five security-focused regressions fail on clean current main before passing with this change.
• Focused auth tests: 30 runs, 90 assertions, 0 failures.
• Ruby 3.2.2, 3.3.7, and 3.4.3: library suite 351 runs / 709 assertions and REST wrapper suite 10,881 runs / 10,911 assertions, all passing on each version.
• RuboCop: 108 files inspected, no offenses on each supported Ruby version.
• Sorbet: no errors on each supported Ruby version.

Checklist:

• My commit messages follow the linked convention.
• I have performed a self-review of my own code.
• I have added tests that prove the fix is effective.
• I have updated the project documentation.
• I have added changelog lines.