fix(security): prevent TOCTOU DNS rebinding SSRF in webhooks

[nyxsky404]

This PR fixes a critical TOCTOU (Time-of-Check to Time-of-Use) vulnerability in the webhook dispatch system. Previously, isSafeUrl performed a DNS resolution to verify the IP, but fetch subsequently performed a second DNS resolution. This allowed attackers to use DNS rebinding (with a low TTL) to bypass SSRF protections and hit internal networks (e.g. 169.254.169.254 or localhost). The fix updates isSafeUrl to return the explicitly validated IP address, which is then passed directly to fetch while pinning the Host header to the original URL's hostname. Fixes #3169.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus