test(auth): lock in unverified for a string verified-email claim

Add a boundary case asserting a string verified_primary_email/
verified_secondary_email equal to the email resolves to unverified —
the old string[] cast would have returned true via String.includes.

Author: waleedlatif1

apps/sim/lib/oauth/microsoft.test.ts

@@ -64,6 +64,11 @@ describe('deriveMicrosoftEmailVerified', () => {
     )
     expect(deriveMicrosoftEmailVerified({ verified_primary_email: null }, EMAIL)).toBe(false)
   })
+
+  it('does not treat a string claim equal to the email as verified (guards the old unsafe cast)', () => {
+    expect(deriveMicrosoftEmailVerified({ verified_primary_email: EMAIL }, EMAIL)).toBe(false)
+    expect(deriveMicrosoftEmailVerified({ verified_secondary_email: EMAIL }, EMAIL)).toBe(false)
+  })
 })
 
 describe('isMicrosoftProvider', () => {