fix: harden SSRF protection and add comprehensive tests
Fix gaps in isAllowedWebhookUrl: IPv6 bracket stripping for [::1],
[fe80::], [::ffff:7f00:1]; block 0.0.0.0 and [::] (IPv6 all-zeros);
handle URL-parser normalized ::ffff:7fxx IPv6-mapped localhost.
Add 20 SSRF test cases covering: file://, gopher://, data: schemes,
localhost, 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, IPv6 ::1,
fe80::, fc00::/fd00::, octal/decimal IP bypass, metadata IP
169.254.169.254, .localhost TLD, overly long URLs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
