Guard scraper against private network URLs

[pragnyanramtha]

Summary

• block scraper requests to private, loopback, link-local, metadata, multicast, and otherwise non-public network targets before fetching
• resolve and validate hostname targets, revalidate redirects, disable proxy/env routing for HTTPX, and bind HTTPX connections to the validated resolved address
• avoid browser DNS rebinding by only using Playwright for literal IP URLs, with route-level blocking for unsafe browser requests

Testing

• .venv/bin/python -m pytest tests/scrape/test_scrape.py -k "private or multicast or rebinding or network_backend or playwright_route"
• .venv/bin/python -m pytest tests/scrape/test_scrape.py tests/scrape/test_playwright_disable.py
• .venv/bin/python -m flake8 aider/scrape.py tests/scrape/test_scrape.py tests/scrape/test_playwright_disable.py
• .venv/bin/python -m compileall aider/scrape.py tests/scrape/test_scrape.py tests/scrape/test_playwright_disable.py
• git diff --check

[CLAassistant]

All committers have signed the CLA.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.