fix: add subdomain validator

[betinacosta]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Adds a shared _validate_tenant_subdomain utility in sap_cloud_sdk.core.url_utils that validates a tenant subdomain against RFC 1123 DNS label rules (ASCII letters, digits, and hyphens only; no leading/trailing hyphens; max 63 characters). The validator is now called before any token URL substitution in:

• AgentGatewayClient._resolve_tenant_subdomain (agentgateway/agw_client.py)
• TokenProvider.get_token (destination/_http.py)
• Auth._resolve_token_url (dms/_auth.py)

A ValueError with a clear message is raised on invalid input instead of silently constructing a malformed URL.

Related Issue

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)

How to Test

1. Install the package locally: pip install -e .
2. Attempt to use AgentGatewayClient with an invalid subdomain:

   from sap_cloud_sdk.agentgateway import AgentGatewayClient
   client = AgentGatewayClient(tenant_subdomain="-invalid")
   client._resolve_tenant_subdomain()  # raises ValueError: Invalid tenant_subdomain

3. Call TokenProvider.get_token(tenant_subdomain="has.dot") in the destination module — expect ValueError: Invalid tenant_subdomain.
4. Call Auth._resolve_token_url("trailing-") in the DMS module — expect ValueError: Invalid tenant_subdomain.
5. Run the unit test suites:

   pytest tests/core/unit/test_url_utils.py
   pytest tests/agentgateway/unit/test_agw_client.py
   pytest tests/destination/unit/test_http.py
   pytest tests/dms/unit/test_auth.py
   

6. Verify all existing tests still pass.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Additional Notes

The validator is intentionally kept internal (_validate_tenant_subdomain) and lives in sap_cloud_sdk.core.url_utils for reuse across all modules that accept a tenant_subdomain parameter. Passing None is a no-op to accommodate callers that resolve the subdomain lazily or make it optional.

[cassiofariasmachado]

Looks good to me. I've just added a minor suggestion