ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API.

Google's v2.4.0, September 11, carries two security-relevant changes in roughly 50 commits: a fetched agent card's interface URLs are pinned to the origin the card came from (#1418), closing a redirect path where a hostile card pointed an agent at a different service, and the adkrest REST API gains authentication and authorization (#1561), which it previously did not have. Other fixes stop ParallelWorker ignoring fail-fast under maxConcurrency, keep consent URIs and caller identifiers out of error text, and stop mcptoolset dropping non-text tool results. A framework's REST API shipping without auth for multiple major versions is the kind of thing to check on every agent dependency you have.