feat: disable automatic security check prompt

[ieow]

Description

This pr remove the enable automatic security check option in the security settings and hide/disable the check prompt on login addressing issue ##
This will resultant the minimum version will always been checked.

Another pr will remove all the logics and metrics

Related issues

Fixes:

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action:

Thank you for your submission, we really appreciate it. We ask that you all read and sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just by adding a comment to this pull request with this exact sentence:

I have read the CLA Document and I hereby sign the CLA

By commenting with the above message you are agreeing to the terms of the CLA. Your account will be recorded as agreeing to our CLA so you don't need to sign it again for future contributions to this repository.

42 out of 60 committers have signed the CLA.
✅ @ieow
✅ @jpuri
✅ @matthewwalsh0
✅ @sahar-fehri
✅ @georgeweiler
✅ @bfullam
✅ @httpJunkie
✅ @owencraston
✅ @davibroc
✅ @Prithpal-Sooriya
✅ @zone-live
✅ @chrisleewilcox
✅ @AugmentedMode
✅ @vinnyhoward
✅ @sethkfman
✅ @georgewrmarshall
✅ @mathieuartu
✅ @adonesky1
✅ @digiwand
✅ @smilingkylan
✅ @dan437
✅ @infiniteflower
✅ @Matt561
✅ @EtherWizard33
✅ @AxelGes
✅ @Cal-L
✅ @dawnseeker8
✅ @ccharly
✅ @bergarces
✅ @tommasini
✅ @ziad-saab
✅ @vinistevam
✅ @jvbriones
✅ @FrederikBolding
✅ @cryptodev-2s
✅ @abretonc7s
✅ @montelaidev
✅ @jiexi
✅ @frankvonhoven
✅ @C-Ivan
✅ @salimtb
✅ @imblue-dabadee
❌ @ffmcgee725
❌ @wachunei
❌ @Andepande
❌ @gantunesr
❌ @OGPoyraz
❌ @mikesposito
❌ @cortisiko
❌ @mcbridemarci
❌ @V00D00-child
❌ @weitingsun
❌ @SteP-n-s
❌ @aganglada
❌ @wenfix
❌ @saraantole
❌ @baptiste-marchand
❌ @Julink-eth
❌ @PatrykLucka
❌ @Tyschenko

To fix the issue, replace the substring check domain.includes('infura.io') with a more robust validation that ensures the domain is either infura.io or a valid subdomain of infura.io. This can be achieved by checking if the domain ends with .infura.io and ensuring there is no trailing dot before the suffix. This approach prevents arbitrary hosts from being incorrectly identified as valid subdomains.

Changes to make:

1. Replace the domain.includes('infura.io') check with a validation that uses domain.endsWith('.infura.io') or checks for exact matches with infura.io.
2. Ensure that the domain is not malformed (e.g., evil-infura.io.example.com).

---

To fix the issue, the code should validate the domain against an explicit whitelist of allowed hosts, ensuring that only legitimate domains are accepted. This involves replacing the domain.endsWith('alchemyapi.io') check with a comparison against a predefined list of trusted Alchemy domains. The fix should also ensure that the domain variable is parsed correctly to extract the host component, avoiding substring-based checks.

Steps to implement the fix:

1. Define a whitelist of allowed Alchemy domains (e.g., ['alchemyapi.io']).
2. Replace the domain.endsWith('alchemyapi.io') check with a validation against the whitelist using strict equality.
3. Ensure that the domain variable is parsed correctly to extract the host component before performing the validation.