Address CodeQL alerts SM05137 and SM02184 in connect flow

[mkrueger]

Summary

Addresses two CodeQL security alerts on the connect flow in ShellInterpreter.cs.

SM05137 — DefaultAzureCredential (false positive in context)

Adds a Microsoft CodeQL inline suppression with justification on the DefaultAzureCredential fallback. This is an interactive developer CLI, not a hosted service: the credential is the last-resort fallback that adopts the developer's local identity (Azure CLI/azd, Visual Studio, env vars, or VM managed identity). No fixed service identity exists to pin to.

SM02184 — Server certificate validation disabled (real cleanup)

Removes the redundant ServerCertificateCustomValidationCallback = (cert, chain, errors) => true in CreateClientOptions.

All emulator connections are routed through BuildEmulatorConnectionString, which appends DisableServerCertificateValidation=True to the connection string. The SDK honors that flag, so cert validation is already skipped for the emulator without the callback. Token-auth paths are only reached for non-emulator endpoints, so the callback was never the sole mechanism on any path. Removing it also drops the now-unused connectionString parameter on CreateClientOptions.

Validation

• dotnet build CosmosDBShell/CosmosDBShell.csproj → 0 Warnings / 0 Errors
• Emulator connect path unchanged in behavior (cert validation still disabled via the connection-string flag)

Commits

• b334a23 Suppress CodeQL SM05137 on DefaultAzureCredential fallback
• bac5492 Remove redundant emulator cert-validation callback (SM02184)

[Copilot]

Pull request overview

This PR updates the Cosmos DB shell “connect” flow to address two CodeQL alerts by (1) removing redundant TLS certificate-validation bypass logic for emulator connections and (2) adding an inline suppression/justification for a DefaultAzureCredential fallback that is intentional for an interactive developer CLI.

Changes:

• Removes ServerCertificateCustomValidationCallback = ... => true for emulator connections and relies on the existing DisableServerCertificateValidation=True connection-string flag.
• Simplifies CreateClientOptions by removing the now-unused connectionString parameter and updates its call sites.
• Adds an inline CodeQL suppression comment for the DefaultAzureCredential fallback path (but the suppression syntax needs a small correction to be effective).