Prevent url requests for internal addresses

[kfranqueiro]

This responds with 400 status to any request whose URL points to an internal/local IP.

• Checks centrally in validateParams which covers all code paths (both GET and POST, all generators) before any generator is called
• Covers IPv4, IPv6, and domain lookups; also rejects non-HTTP(S) URLs
• If the initial URL is determined to be unicast, also performs HEAD request(s) to check for redirects to an internal host
• Centralizes one regular expression which had previously existed in generators/bikeshed.ts

I've added a collection of test cases which go through the full code path to verify the 400 response from the server and the proper handling of all types of URLs (including IPv6 which need to be enclosed in square brackets). The one thing that wouldn't be straightforward to automate testing of is the maximum redirects handling, which I have verified manually for the time being. (We might be able to introduce nock to this repo to automate testing that case, but perhaps I should do that separately later.)

[deniak]

The PR looks good to me. Regarding the tests on the redirects, instead of relying on another nock, it seems possible to use globalThis to override the fetch behavior to return a redirect:

import assert from "assert";
import { afterEach, beforeEach, describe, it } from "node:test";

describe("redirect following", () => {
  const originalFetch = globalThis.fetch;

  afterEach(() => {
    globalThis.fetch = originalFetch;
  });

  function mockRedirectTo(location: string) {
    globalThis.fetch = async () =>
      new Response(null, { status: 307, headers: { location } });
  }

  it("blocks a redirect to a private IP", async () => {
    mockRedirectTo("https://192.168.1.1/");
    assert.equal(await isUnicastHttpUrl("https://example.com/"), false);
  });
  ...
});

Similarly, it should be possible to create an infinite redirect loop by redirecting to the same URL.

[kfranqueiro]

Fair point, since the HEAD requests are all that would need to be mocked and those specifically use fetch, we can get away with only mocking that directly. I've added 2 redirect tests, one redirecting to an internal IP and one redirecting infinitely.