fix: authenticate Feishu and Teams webhooks

[yaojin3616]

Summary

• validate Feishu callback tokens, decrypt encrypted envelopes, and verify signed requests
• validate Bot Framework JWTs and bind the serviceUrl claim before persisting a Teams reply endpoint
• require a Teams app ID even when managed identity is selected, so JWT audiences can be validated

Verification

• PYTHONPATH=. uv run --extra dev pytest tests/test_feishu_channel_runtime.py tests/test_http_channel_runtime.py tests/test_agent_runtime_channel_provider_delivery.py

Internal Feishu report: 公开渠道入口认证不完整。Feishu webhook 缺少完整验签；Teams 未验证 Bot Framework JWT，还信任请求中的 serviceUrl，可能把 Teams bearer token 发送到攻击者地址