fix(utils): harden web URL fetch against SSRF

[EaEa0001]

Summary

• add URL validation for web fetch utility to only allow http/https
• block localhost, loopback, link-local, and private network IP targets
• resolve hostnames and reject non-public resolved addresses
• disable automatic redirects and validate each redirect hop before following
• add SSRF-focused tests for literal IP, DNS-to-private, redirect-to-loopback, public allowlist path, and binary fallback

Security Impact

This reduces SSRF risk in _get_bytes_from_web_url by preventing access to internal/local network resources and unsafe redirects.

Tests

• PYTHONPATH=src python3 -m unittest tests.common_utils_security_test -v

[cla-assistant]

All committers have signed the CLA.

[EaEa0001]

Closed per author request.