Improve Security Boundary for TOFU URLs

Summary

Before Cryptomator connects to unknown URLs (i.e. when unlocking a hub vault), users have to review and trust these URLs. Currently, such urls are trusted independently. This means once trused, these URLs can be mixed (i.e. in a hub vautl config). To increase security, we should extend the trust concept to sets of "urls". If two already trusted URLs belong to two different sets, they are not trusted in combination.

Please agree to the following

• I have searched existing issues for duplicates
• I agree to follow this project's Code of Conduct

Motivation

The Hub vault-config contains two endpoints: authEndpoint and apiBaseUrl. Cryptomator follows the TOFU principle to trust these URLs.

The app-internal trust check validates both against a flat, app-wide trusted-hosts set independently, without confirming they belong to the same trusted Hub instance. This means a vault config can be edited such that authEndpoint/tokenEndpoint points to an already-trusted Hub host A, but apiBaseUrl points to a different but-already trusted host B, is still accepted.

Such edits should be made visible to the user and asked again for trust (in that specific combination).

Considered Alternatives

No response

Anything else?

This issue was found by Aakarshit Bargotra and they responsibly disclosed it to us.

Note that this is not a vulnerability, because the TOFU principle still holds: Both URLs have to be trusted.