Describe what the web fetch blocklist now covers beyond metadata endpoints

The default blocklist was consolidated onto the request path and extended well past the cloud metadata addresses, while the entry still listed only those five. It now also covers the Azure platform channel reachable from every virtual machine, multicast ranges, the deprecated 6to4 relay and IPv6 site-local ranges, the anycast addresses answered by the local network's own edge device, and several prefixes reserved by specification but never routed.

The description names those categories in plain terms rather than reciting every prefix, since an operator reading it wants to know what is already handled before adding entries of their own.

Author: Classic298

docs/reference/env-configuration.mdx

@@ -4550,7 +4550,7 @@ This Tenant ID (also known as Directory ID) is required for the work/school inte
 
 - Type: `string` (comma-separated list)
 - Default: `""` (empty, but default blocklist is always applied)
-- Description: Configures additional URL filtering rules for web fetch operations to prevent Server-Side Request Forgery (SSRF) attacks. The system includes a default blocklist that protects against access to cloud metadata endpoints (AWS, Google Cloud, Azure, Alibaba Cloud). Entries without a ! prefix are treated as an allow list (only these domains are permitted), while entries with a ! prefix are added to the block list (these domains are always denied). The default blocklist includes !169.254.169.254, !fd00:ec2::254, !metadata.google.internal, !metadata.azure.com, and !100.100.100.200. Custom entries are merged with the default blocklist.
+- Description: Configures additional URL filtering rules for web fetch operations to prevent Server-Side Request Forgery (SSRF) attacks. The system includes a default blocklist that protects against access to cloud metadata endpoints (AWS, Google Cloud, Azure, Alibaba Cloud). Entries without a ! prefix are treated as an allow list (only these domains are permitted), while entries with a ! prefix are added to the block list (these domains are always denied). The default blocklist covers the cloud metadata addresses (`!169.254.169.254`, `!fd00:ec2::254`, `!metadata.google.internal`, `!metadata.azure.com`, `!100.100.100.200`) and, alongside them, a set of addresses that are never a legitimate destination for a fetch: the Azure platform channel reachable from every virtual machine, multicast ranges, the deprecated 6to4 relay and IPv6 site-local ranges, the anycast addresses answered by the local network's own edge device, and several prefixes reserved by specification but never routed. Custom entries are merged with it.
 
 :::info
 Example: