Remove dead links to deleted Sourcegraph dev docs

The testing principles, Go testing, telemetry, and CSRF security model
pages no longer exist on sourcegraph.com/docs. Replace the links with
plain text and inline the relevant context in the code comment.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: bahrmichael

DEVELOPMENT.md

@@ -62,7 +62,7 @@ For quick end-to-end CLI sanity checks against a live Sourcegraph instance, run:
 
 This script intentionally uses your currently exported `SRC_*` environment variables, is not hooked up to CI, and is meant for manual regression checks (for example, to catch issues like `src users list` failing unexpectedly).
 
-We adhere to the [general Sourcegraph principles for testing](https://sourcegraph.com/docs/dev/background-information/testing_principles), as well as [the Go specific directions](https://sourcegraph.com/docs/dev/background-information/languages/testing_go_code), at least to the extent they apply to a standalone tool like `src`.
+We adhere to the general Sourcegraph principles for testing, as well as the Go specific directions used in the main Sourcegraph repository, at least to the extent they apply to a standalone tool like `src`.
 
 ## Releasing
 

README.md

@@ -211,7 +211,7 @@ src-cli/3.21.10 linux amd64
 
 To disable this and _only_ send the version, you can set `-user-agent-telemetry=false` for a single command, or set the `SRC_DISABLE_USER_AGENT_TELEMETRY` environment variable to any non-blank string.
 
-As with [other Sourcegraph telemetry](https://sourcegraph.com/docs/dev/background-information/telemetry), any collected data is only sent to Sourcegraph.com in aggregate form.
+As with other Sourcegraph telemetry, any collected data is only sent to Sourcegraph.com in aggregate form.
 
 ## Development
 

internal/users/admin.go

@@ -261,8 +261,9 @@ func (c *Client) GraphQL(token, query string, variables map[string]any, target a
 	if token != "" {
 		req.Header.Set("Authorization", fmt.Sprintf("token %s", token))
 	} else {
-		// NOTE: This header is required to authenticate our session with a session cookie, see:
-		// https://sourcegraph.com/docs/dev/security/csrf_security_model#authentication-in-api-endpoints
+		// NOTE: This header is required to authenticate our session with a session
+		// cookie. Sourcegraph's CSRF protection rejects cookie-authenticated API
+		// requests that do not carry this header.
 		req.Header.Set("X-Requested-With", "Sourcegraph")
 		req.AddCookie(c.sessionCookie)