feat: add SSRF protection for df.http()

Add compile-time dataplane protection that blocks HTTP requests to
private/reserved IP ranges from the background worker. This prevents
malicious users from using df.http() to probe internal network services,
cloud metadata endpoints, or localhost services.

Implementation:
- New src/ssrf.rs module with IP blocklist (RFC 1918, loopback,
  link-local, ULA) and custom DNS resolver (SsrfSafeResolver)
- Scheme validation: only http:// and https:// allowed
- IPv4-mapped IPv6 handling (::ffff:A.B.C.D)
- DNS rebinding protection via inline IP check before connect
- Cargo feature 'ssrf-protection' (default=on), no runtime bypass
- Audit logging: submitted_by and login_role on all HTTP requests
- New spec: docs/spec-ssrf-protection.md

Addresses threat T8 in spec-security-model.md.

Author: pinodeca

Cargo.toml

@@ -14,7 +14,8 @@ name = "pgrx_embed_pg_durable"
 path = "./src/bin/pgrx_embed.rs"
 
 [features]
-default = ["pg17"]
+default = ["pg17", "ssrf-protection"]
+ssrf-protection = []
 pg13 = ["pgrx/pg13", "pgrx-tests/pg13" ]
 pg14 = ["pgrx/pg14", "pgrx-tests/pg14" ]
 pg15 = ["pgrx/pg15", "pgrx-tests/pg15" ]