Add config updates via SSE (behind FF)

[timokoessler]

Feature Flag env: AIKIDO_FEATURE_SSE

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 1	Resolved Issues: 0

🚀 New Features

• Implemented SSE client and parser to receive realtime events.

⚡ Enhancements

• Added listener to fetch config updates via SSE when signaled.
• Integrated SSE listener into CloudConnectionManager guarded by feature flag.

🔧 Refactors

• Replaced hardcoded realtime endpoint with get_api_url for requests.

^{More info}

[aikido-pr-checks]

Callback mutates nonlocal last_updated_at and calls connection_manager.update_service_config/update_firewall_lists from a background thread. Synchronize access (e.g., use a lock) or confine mutations to a single thread.

Details

✨ AI Reasoning
​The listen_for_config_updates change defines on_event which captures and mutates last_updated_at and invokes connection_manager.update_service_config and update_firewall_lists. That callback is passed to connect_to_sse which starts a background thread, so those mutations now occur concurrently without synchronization. This introduces a new unsynchronized access path to connection_manager state from a background thread.

🔧 How do I fix it?
Use locks, concurrent collections, or atomic operations when accessing shared mutable state. Avoid modifying collections during iteration. Use proper synchronization primitives like mutex, lock, or thread-safe data structures.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}