Guard DRep metadata URL fetches against SSRF

[Dreamstore2046]

Summary

• validate DRep metadata URLs before the backend fetches them server-side
• reject unsupported protocols, private/reserved IPv4 ranges, loopback/link-local/unique-local IPv6 ranges, and hostnames that resolve to blocked addresses
• disable redirects for DRep metadata fetches so an allowed URL cannot redirect into an internal service
• return URL_NOT_FOUND when metadata validation rejects an unsafe URL
• add Jest coverage for protocol rejection, private literal IPs, private DNS results, IPv6 blocking, and redirect configuration

Fixes #15

Validation

• corepack yarn test --runInBand
• corepack yarn build