feat(pdftract-core): add SSRF protection (TH-05) and URL_PRIVATE_NETWORK diagnostic
Add URL validation module to prevent SSRF attacks by blocking:
- RFC 1918 private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- IPv6 ULA (fc00::/7, fd00::/8)
- Loopback addresses (127.0.0.0/8, ::1)
- Link-local addresses (169.254.0.0/16, fe80::/10)
- Cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.)
- Non-https schemes (http://, ftp://, file://)
Add URL_PRIVATE_NETWORK diagnostic code to diagnostics catalog.
Add comprehensive test suite in tests/th_05_ssrf_block.rs covering:
- 20+ dangerous URL payloads across all categories
- --allow-private-networks bypass functionality
- IPv6 zone ID detection
- Metadata subdomain detection
- Boundary address validation
Closes: pdftract-zgdkf (TH-05 test: SSRF block)
76114da985