Restrict MSGraph deferrable pagination to the configured host

[FrankYang0529]

Why

• When MSGraphAsyncOperator fetches the next page, the url comes from the previous response. The Kiota adapter attaches the connection's access token to every request it sends. Nothing checks that url before the request goes out.

How

• Extract the netloc comparison that paginated_run() already does (added in Restrict MSGraph pagination nextLink to the configured host #69742) into KiotaRequestAdapterHook.assert_allowed_host(). The allowed host comes from the request adapter's base_url.
• Add pagination_link: bool = False to MSGraphTrigger, carry it through serialize(), and call the helper at the top of run() when it is set. MSGraphAsyncOperator.trigger_next_link() passes pagination_link=True, so the check applies only to urls that came back from a response.
• Relative urls still pass the check. Airflow's own $top/$skip branch and a custom pagination_function can both produce one, so assert_allowed_host() returns early for any url that is not absolute.

Verification

• uv run --project providers/microsoft/azure pytest providers/microsoft/azure/tests/unit/microsoft/azure -k msgraph

---

Was generative AI tooling used to co-author this PR?

• Yes - Claude Code

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.