Block private IPv6 webhook URLs

[aiirvizionz]

Summary

• move the webhook SSRF URL guard into a small pure helper
• block IPv6 loopback, link-local, ULA, and private IPv4-mapped IPv6 webhook targets
• keep public IPv6 and public IPv4-mapped IPv6 targets allowed

Validation

• node --test tests\\url-guard.test.mjs
• npx tsc --noEmit --incremental false
• git diff --check

Note: npm exec -- next lint is interactive in this checkout because the repo has no ESLint config yet, so I did not let it write config files.