security: prevent SSRF in proxy route

[jahvari]

Summary

Addresses stremio-native#34 by making the /proxy route fail
closed against SSRF, DNS rebinding, credential leakage, recursive self-proxying,
and unbounded response/playlist resource use while preserving the installed
Stremio Server 4.20.15 proxy contract where it is safe.

This PR:

• permits only validated HTTP(S) destinations and pins every DNS answer on
  every redirect hop;
• denies metadata, special-purpose, private/local, and active listener sockets
  by default, including mapped IPv4, NAT64/Pref64, scoped IPv6, and mixed-answer
  bypasses;
• adds protected, global opt-ins for legitimate private/LAN sources and invalid
  upstream TLS certificates, exposed through the tray/GUI, API, settings file,
  and environment variables;
• protects those settings with a loopback-only control token and cancellation-
  safe raw/effective settings persistence;
• isolates active-content responses, strips redirect credentials across
  origins, pins a no-proxy client, and prevents public caching of credentialed
  responses;
• bounds raw requests, DNS, redirects, headers, active streams, HLS input/output,
  per-peer/global admission, read-idle, response-header, collection, delivery,
  and downstream-stall lifetimes;
• preserves safe HLS header/response options, variables, URL forms, and all
  installed playlist line delimiters;
• redacts proxy targets and credentials from logs/diagnostics and excludes
  opaque crash dumps from exported ZIP files;
• documents configuration, limits, firewall responsibility, compatibility
  differences, and residual risks in docs/network-source-security.md.

Secure defaults and intentional differences

Private/LAN destinations and invalid upstream TLS certificates remain disabled
by default. Metadata and the server's own listeners are always denied. Cross-
origin redirects discard every caller-supplied custom request header, not only
the legacy credential names. RFC redirect method semantics and RFC-relative URL
resolution replace observable legacy bugs. Rewritten playlists are limited to
complete transformable 200 representations; partial or no-transform
responses stream unchanged.

The application-layer policy is intentionally scoped to /proxy; it does not
claim to secure every outbound URL sink or make the unauthenticated service safe
for public exposure. It does not alter Windows Firewall rules.

Verification

Fresh local verification on 0a4d362749b2543c4d2ff3e016ee2ae13600f33b:

• network-security unit tests: 67 passed;
• proxy unit tests: 136 passed;
• settings-route unit tests: 12 passed;
• embedded proxy-security integration tests: 8 passed;
• settings GUI security tests: 6 passed;
• librqbit two-package test gate: 58 enginefs tests, 293 server tests, embed
  smoke, 8 proxy-security integrations, and doc tests passed (one intentional
  FFmpeg download test ignored);
• broader librqbit workspace tests passed for all non-native workspace crates;
• all-target librqbit Clippy with -D warnings, cargo fmt --check, release-note
  tests (6/6), and git diff --check passed;
• RustSec: no known vulnerabilities; 18 documented allowed transitive warnings;
• controlled public HTTPS, range, playlist, LAN opt-in, TLS opt-in, metadata
  redirect, self-listener, cancellation, and diagnostic-redaction smoke passed;
• final fresh audit: 0 new Critical, Important, or Minor actionable findings.
• fork CI run 32518158264 passed native libtorrent workspace Clippy/tests and
  all-target librqbit Clippy/tests on Ubuntu.

The fork PR's successful Ubuntu check supplies the native libtorrent and
Unix-only platform evidence unavailable on this Windows workstation.

Scope

This branch is based on the fork's master, including its previously merged
dependency upgrades. Any later upstream submission will be a separately
reviewed clean replay based on stremio-native/stream-server:master; no upstream
branch or PR is created by this fork submission.