security: prevent SSRF in proxy route

[jahvari]

Summary

Addresses stremio-native#34 by making the /proxy route fail
closed against SSRF, DNS rebinding, credential leakage, recursive self-proxying,
and unbounded response/playlist resource use while preserving the installed
Stremio Server 4.20.15 proxy contract where it is safe.

This PR:

• permits only validated HTTP(S) destinations and pins every DNS answer on
  every redirect hop;
• denies metadata, special-purpose, private/local, and active listener sockets
  by default, including mapped IPv4, NAT64/Pref64, scoped IPv6, and mixed-answer
  bypasses;
• adds protected, global opt-ins for legitimate private/LAN sources and invalid
  upstream TLS certificates, exposed through the tray/GUI, API, settings file,
  and environment variables;
• protects those settings with a loopback-only control token and cancellation-
  safe raw/effective settings persistence;
• isolates active-content responses, strips redirect credentials across
  origins, pins a no-proxy client, and prevents public caching of credentialed
  responses;
• bounds raw requests, DNS, redirects, headers, active streams, HLS input/output,
  per-peer/global admission, read-idle, response-header, collection, delivery,
  and downstream-stall lifetimes;
• preserves safe HLS header/response options, variables, URL forms, and all
  installed playlist line delimiters;
• redacts proxy targets and credentials from logs/diagnostics and excludes
  opaque crash dumps from exported ZIP files;
• documents configuration, limits, firewall responsibility, compatibility
  differences, and residual risks in docs/network-source-security.md.

Secure defaults and intentional differences

Private/LAN destinations and invalid upstream TLS certificates remain disabled
by default. Metadata and the server's own listeners are always denied. Cross-
origin redirects discard every caller-supplied custom request header, not only
the legacy credential names. RFC redirect method semantics and RFC-relative URL
resolution replace observable legacy bugs. Rewritten playlists are limited to
complete transformable 200 representations; partial or no-transform
responses stream unchanged.

The application-layer policy is intentionally scoped to /proxy; it does not
claim to secure every outbound URL sink or make the unauthenticated service safe
for public exposure. It does not alter Windows Firewall rules.

Verification

Final verification at exact head 8b414273435a2bb2e4d6287079880ee9d52633f1:

• fork CI run 33112228438 passed Linux libtorrent and librqbit workspace
  checks, strict Clippy, and tests in 15m12s;
• the same run passed Windows native FFI check, strict Clippy, and repeated
  shutdown testing in 16m55s;
• the first post-merge run exposed one scheduler-sensitive test assertion after
  394 server tests passed; the test-only bounded-wait correction is included in
  the final green run;
• local settings-GUI check, strict Clippy, and all 6 tests passed;
• formatting, Cargo metadata, diff-integrity, clean-worktree, and public-content
  scans passed;
• RustSec reports no known vulnerabilities and 18 documented allowed transitive
  maintenance/unsoundness warnings;
• committed localhost TLS fixture material was removed from the final tree;
  HTTPS tests now generate fresh self-signed certificate/key pairs in temporary
  directories;
• final security and integration audit converged with no remaining actionable
  Critical, Important, or Minor findings.

Related dependency PR

Dependency modernization remains intentionally separate in
stremio-native#36. This fork branch incorporates that dependency
baseline through fork master; the proxy hardening and dependency modernization
remain separate upstream review units and both are expected to land.

Scope

This PR targets jahvari/stream-server:master only. It does not create, update,
merge, or close an upstream branch or PR.