fix(metadata-validation): complete SSRF protection

[kusssal]

List of changes

• Disable automatic redirects and proxy routing for metadata requests
• Improve IPv4 and IPv6 validation using ipaddr.js
• Block IPv4-mapped IPv6 and special-use IP ranges
• Preserve connection-time DNS rebinding protection and URL_BLOCKED errors
• Add SSRF regression tests

Checklist

• [Related issue #4142](🐛 [Bounty] - SSRF in Metadata-Validation Service via Loopback Escalation to Localhost #4142)
• My changes generate no new warnings
• My code follows the [style guidelines](https://github.com/IntersectMBO/govtool/tree/main/docs/style-guides) of this project
• [] I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the [changelog](https://github.com/IntersectMBO/govtool/blob/main/CHANGELOG.md)
• I have added tests that prove my fix is effective or that my feature works