* fix: block SSRF via user-supplied model endpoint URLs
* fix(test): stub DNS in loopback SSRF tests for deterministic results
Replace environment-dependent test_loopback_always_rejected with two
deterministic tests using a stub resolver:
- test_loopback_accepted_by_default (local-first, block_private=False)
- test_loopback_rejected_in_strict_mode (block_private=True)
The old test only passed when localhost resolved to ::1 (hit is_reserved),
not because loopback was actually always rejected.
Co-Authored-By: Santoshkumarpuppala
* fix: guard PATCH base_url against SSRF and add ipv6 loopback coverage
---------
Co-authored-by: isharak7m <192635824+isharak7m@users.noreply.github.com>
