gRPC for Dart 5.2

Apply these rules to the grpc package's 5.2 release line on native Dart, Flutter, and its gRPC-Web client. The Dart baseline applies first.

Transport and peer identity

• Expose a network-facing Server with Server.serve(address: ..., security: ServerTlsCredentials(...)) or a trusted TLS terminator, supplying a server certificate and private key. An omitted address binds all IPv4 interfaces, and a listener without security is cleartext; keep any cleartext backend unreachable except from its terminator.
• Bind local-only servers to InternetAddress.loopbackIPv4, loopbackIPv6, or a protected Unix socket. Do not rely on ServerLocalCredentials or an overridden validateClient to reject remote peers: the socket accept path does not invoke that method.
• Where client certificates identify callers, use a ServerCredentials.securityContext that trusts the intended client CAs, require client certificates with Server.serve(requireClientCertificate: true), and map the verified ServiceCall.clientCertificate to an application principal. requestClientCertificate alone permits clients without certificates. ChannelCredentials.secure(certificates: ...) configures client trust roots, not a client certificate.
• Use the default secure ChannelOptions.credentials or ChannelCredentials.secure with trusted roots and the expected server name. Keep ChannelCredentials.insecure on isolated local or separately protected links. Never set onBadCertificate to accept arbitrary certificates or call allowBadCertificates in deployed code; do not point authority at a