ssrf_safe_get: HTTPS requests re-resolve DNS after validation (rebinding window)

[nmgarza5]

For HTTPS, _make_ssrf_safe_request in backend/onyx/utils/url.py validates one DNS resolution but then requests the original URL because TLS SNI needs the hostname, so the client resolves again and a rebinding DNS server can route the actual request to a private address. The code comments acknowledge the window. Affects every ssrf_safe_get caller (open_url, JWT key fetch from #14153, etc). Proper fix: pin the validated IP with a custom transport adapter that sets server_hostname/SNI explicitly. Surfaced by Greptile review on #14153.

[nmgarza5]

Fixed on #14153 in a5aec7c: ssrf_safe_get now resolves once and pins the validated IP through TLS (SNI and certificate verification against the real hostname via a custom adapter) on both the strict and permissive paths, so no caller re-resolves DNS after validation. Closing when #14153 merges.