Issue #3610442: Fix outcome result_scope bug, add missing interaction config schema, harden interaction and client security

Frank Mablyrequested to merge
issue/orchestra-3610442:3610442-fix-outcome-resultscope into 1.x

Fixes [#3610442]. See the issue for full detail.

Audit fixes in one MR:

  1. Bug — WorkflowExecutor::recordResult()/recordOutcome() destructured the VariableScope enum into a $scoped var used as a boolean (always truthy), so result_scope: instance was written token-scoped. Now compares $scope === VariableScope::Token, matching resumeParked().
  2. Config schema — added orchestra.interaction.comment and orchestra.interaction.entity_form (the node schema has no wildcard fallback, so these plugins failed strict validation).
  3. Security (low) — Referrer-Policy: no-referrer on the interaction dispatcher responses so the URL capability token can't leak via Referer.
  4. Security (low) — orchestra_client base URL now requires https:// (loopback excepted).

Adds Kernel regression tests asserting the outcome result is stored at the configured scope. phpcs + php -l clean.

Merge request reports