[code-apps][Docs] Align direct HTTP guidance with configurable CSP

[LeonardSEO]

Plugin

code-apps

Problem

The current shared guidance says direct browser HTTP calls cannot work because code apps run in a sandbox. The current Code Apps CSP documentation is more nuanced: connect-src defaults to 'none', but an environment administrator can configure explicit origins at the environment level.

That blanket statement can cause an agent to misdiagnose CSP failures and reject a controlled custom-backend architecture even when CSP, CORS, and authentication are deliberately configured.

Proposed documentation change

Would maintainers welcome a small documentation-only pull request that:

1. keeps Power Platform connectors as the first choice when they support the required capability;
2. prefers a custom connector for shared authentication, governance, and reuse;
3. permits direct browser HTTP only for a controlled custom backend after verifying explicit HTTPS origins, Code Apps CSP, backend CORS, browser-safe authentication, backend-side authorization, and tenant governance;
4. prohibits wildcards, disabling CSP as a workaround, and secrets or long-lived privileged tokens in frontend code;
5. distinguishes CSP violations, CORS failures, network failures, and HTTP 401/403 responses during diagnosis; and
6. requires explicit approval before an agent proposes an environment-wide CSP change as a concrete administrative action.

The change would leave connector skills, CLI contracts, and deployment behavior untouched.

Official references

• https://learn.microsoft.com/en-us/power-apps/developer/code-apps/how-to/content-security-policy
• https://learn.microsoft.com/en-us/connectors/custom-connectors/create-custom-connector-aad-protected-azure-functions
• https://learn.microsoft.com/en-us/connectors/custom-connectors/use-custom-connector-powerapps

Per CONTRIBUTING.md, I will wait for confirmation before opening a pull request.