fix(security): add SSRF protection for webhook and MCP server URLs

[JasonOA888]

Vulnerability: Server-Side Request Forgery (SSRF) via Webhook and MCP Server URLs (P0)

Summary

Users can configure webhookUrl (in project settings) and customMcpServers[].serverUrl (in MCP server config) to point to internal network addresses. The existing validateHttpHttpsUrl only checks the protocol scheme but does not validate that the resolved IP address is not private/internal.

Impact

• Cloud metadata exfiltration: An attacker can set a webhook URL to http://169.254.169.254/latest/meta-data/ (AWS/GCP/Azure metadata endpoint) to steal cloud credentials, IAM roles, and instance metadata.
• Internal network scanning: Attackers can probe internal services on 10.x.x.x, 192.168.x.x, 172.16-31.x.x ranges.
• Local service access: Requests to localhost/127.0.0.1 can reach internal services not meant to be externally accessible.

Fix

1. Created a shared SSRF validation utility (apps/rowboat/app/lib/ssrf-protection.ts) that:

   • Parses the URL and checks for localhost patterns
   • Resolves DNS to get actual IP addresses
   • Validates against a comprehensive list of private/reserved IP ranges:
     • 10.0.0.0/8 (Class A private)
     • 172.16.0.0/12 (Class B private)
     • 192.168.0.0/16 (Class C private)
     • 127.0.0.0/8 (Loopback)
     • 169.254.0.0/16 (Link-local / cloud metadata)
     • ::1 (IPv6 loopback)
     • fc00::/7 (IPv6 unique local)
     • Plus multicast, reserved, test-net, and other special ranges
   • Supports IPv6 including IPv4-mapped addresses

2. Enhanced validateHttpHttpsUrl in add-custom-mcp-server.use-case.ts to call the SSRF validator before accepting a custom MCP server URL.

3. Added SSRF check before the fetch(project.webhookUrl, ...) call in agent-tools.ts to validate webhook URLs at invocation time.

Test Plan

• Set webhookUrl to http://169.254.169.254/latest/meta-data/ — should be rejected
• Set webhookUrl to http://localhost:8080 — should be rejected
• Set webhookUrl to http://10.0.0.1/internal — should be rejected
• Set webhookUrl to http://192.168.1.1/admin — should be rejected
• Set webhookUrl to a valid public URL — should work normally
• Same tests for customMcpServers[].serverUrl