Add private IP and cloud metadata endpoint blocking as defense-in-depth

[clcollins]

Feature Request

Add explicit blocking of requests to private IP ranges and cloud provider metadata endpoints as a defense-in-depth layer on top of the existing SSRF prevention.

Motivation

The current SSRF mitigation validates that request URLs match the configured base_url prefix, which prevents an agent from reaching arbitrary endpoints. However, if a misconfigured service has a broad base_url or if a future feature (like domain matching) relaxes URL validation, explicit private IP blocking provides a safety net.

Endpoints to block

• RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Loopback: 127.0.0.0/8, ::1
• Link-local: 169.254.0.0/16 (includes AWS/GCP/Azure metadata at 169.254.169.254)
• Cloud metadata endpoints: metadata.google.internal, 169.254.169.254

Behavior

• Before executing any HTTP request, resolve the target hostname and check the resulting IP against the blocked ranges
• Block by default; allow override per-service in config for legitimate internal API use cases:

services:
  internal-api:
    base_url: "https://internal.corp.example.com"
    allow_private: true    # explicitly opt in to private IP targets
    auth:
      type: bearer
      token: {env: "INTERNAL_TOKEN"}

• Log blocked requests to stderr with the target hostname and resolved IP

Security context

This is defense-in-depth — the existing base_url prefix check already prevents most SSRF. This feature adds a second validation layer that catches edge cases from misconfiguration or future feature additions.