docs: clarify private-network SSRF mode

[AjTheSpidey]

Fixes #832.

I believe the missing bit was the private-network case: moderate is documented for localhost, but it still blocks RFC1918 addresses such as 192.168.x.x, 10.x.x.x, and 172.16.x.x.

This adds a small self-hosting section with a Docker example using WEBHOOK_SECURITY_MODE=permissive, and calls out that it still blocks cloud metadata endpoints. I kept it focused on the private-network docs because there is already a separate self-signed certificate PR open.

Checked locally:

• git diff --check origin/main...HEAD