## Summary

The koku-metrics-operator CostManagementMetricsConfig CRD exposes `spec.authentication.token_url` as a writable field with no host validation. When `spec.authentication.type == service-account`, the operator POSTs `client_id` and `client_secret` (read from a user-referenced Secret) as form data to this user-supplied URL. The default is the Red Hat SSO endpoint, but a CR editor can override it to any URL.

## Impact

A principal with `create`/`update` permission on `costmanagementmetricsconfigs` can redirect the tenant's Red Hat SSO `client_id`/`client_secret` pair to an attacker endpoint. These credentials grant `api.console` scope on `console.redhat.com` for the customer organization.

## Affected Code

- `api/v1beta1/metricsconfig_types.go:117` — `token_url` field definition (no validation)
- `internal/controller/costmanagementmetricsconfig_controller.go:450` — `GetAccessToken(ctx, cr.Spec.Authentication.TokenURL)` call
- `internal/crhchttp/config.go:75-93` — POST to user-supplied `tokenURL`

## Remediation

Hard-code the Red Hat SSO token endpoint or enforce a suffix allow-list (`*.redhat.com`) in `GetAccessToken`. Reject non-HTTPS schemes:

```go
if !strings.HasSuffix(tokenURL, ".redhat.com") {
    return "", fmt.Errorf("token_url must be a *.redhat.com endpoint")
}
```