[Security] Restrict Open Design tool base URLs and prevent SSRF

[juancarlosrodicio]

Problem

The Open Design tools accept a model/tool-controlled `baseUrl` and pass it directly to `fetch`:

• `opencode/tools/open_design.ts:35-47` accepts any non-empty string from the argument or `OPEN_DESIGN_URL`.
• `opencode/tools/open_design.ts:49-71` constructs requests from that string.
• All exposed operations make `baseUrl` optional, so a caller can override the configured endpoint per request.

There is no URL parsing, origin allowlist, private/link-local address rejection, or redirect policy.

Impact

A prompt-influenced agent can direct the tool at localhost, a private network service, or a cloud metadata endpoint instead of the intended Open Design server. The response is returned to the agent, creating an SSRF and internal-network discovery primitive; combined with another network-capable tool, this can become data exfiltration.

Suggested direction

• Parse the URL with the platform URL implementation and allow only `http:`/ `https:`.
• Treat `OPEN_DESIGN_URL` as the configured origin and reject per-call origins by default.
• If explicit overrides are necessary, require an explicit operator opt-in and validate the resolved address against a denylist for loopback, link-local, RFC1918, IPv6 private, and Unix/local targets.
• Disable redirects or validate every redirect destination.
• Do not include credentials in arbitrary requests.

Acceptance criteria

1. Requests to loopback, link-local, metadata, private, and unsupported schemes are rejected before network I/O.
2. A per-call `baseUrl` pointing to a different origin is rejected unless an explicit opt-in is present.
3. Redirects cannot escape the validated origin/address policy.
4. Tests cover IPv4, IPv6, DNS-resolved private addresses, malformed URLs, and a valid configured Open Design endpoint.