test(multimodal): harden SSRF rejection paths

[pskiran1]

Overview:

This PR closes SSRF error-propagation gaps for multimodal media URLs. When Dynamo rejects a media URL, the rejection must remain terminal. No adapter, connector, batch loader, or fallback should retry the URL or continue fetching other media.
This PR fixes paths where a typed rejection could be swallowed or treated as recoverable. It also adds request-level tests that use a real network listener to confirm that blocked destinations receive zero connection attempts.

Details:

• SGLang’s NVDEC adapter path now re-raises URL-validation and HTTP-status errors instead of handling them as generic decode failures and falling back to URL passthrough.
• Rust’s media loader now returns typed InvalidArgument errors for policy violations, including blocked schemes, hostnames, IP ranges, DNS-resolved private addresses, and redirect destinations.
• Rust redirect errors preserve policy classification, while ordinary DNS, connection, and transport failures remain non-policy errors.
• Rust multimodal routing now preserves terminal versus recoverable image-dimension failures through its cache. Policy rejections stop the request, while ordinary image-header failures can still use the existing routing fallback.
• Added a shared loopback TCP canary for request-level tests. It counts connection attempts and tests that blocked destinations receive zero outbound connections.
• Added adapter and batch tests for image, audio, and video loaders, the vLLM media connector, SGLang, and TensorRT-LLM.
• The adapter tests inject both UrlValidationError and HttpStatusError, verify that the same error instance escapes, and confirm that fallback and downstream fetch methods are not called.
• Added a direct comparison between the Python and Rust production IP and hostname blocklists.
• Added a Python backend-decoding request test that confirms a blocked URL returns 4xx with zero outbound connections.
• Added a GPU request-level test that starts a real frontend and worker in both vLLM frontend-processor and Rust frontend-decoding topologies. Both must return 4xx and make zero connections to the blocked destination.

Where should the reviewer start?

• lib/llm/src/preprocessor/media/loader.rs — typed Rust policy errors, redirect handling, DNS checks, and fetcher tests.
• lib/llm/src/preprocessor.rs — preservation of terminal policy errors through the dimension cache and MM-routing URL-passthrough path.
• components/src/dynamo/sglang/request_handlers/multimodal/encode_worker_handler.py — the terminal-error guard in _maybe_nvdec_decoder.
• components/src/dynamo/common/tests/multimodal/ — batch propagation and vLLM connector fallback contracts.
• components/src/dynamo/trtllm/tests/test_trtllm_multimodal_processor.py — exact error propagation and prevention of later media fetches.
• tests/frontend/test_http_status_propagation.py — Python backend request-level 4xx and zero-egress coverage.
• tests/mm_router/test_vllm_frontend_ssrf_e2e.py — vLLM and Rust frontend request-level coverage.
• tests/utils/network_canary.py — shared connection-counting test helper.

Related Issues

⚠️ This section is required. Choose one path below and delete the other.

🔗 This PR is linked to an issue:

• Closes DIS-2670

🚫 This PR is NOT linked to an issue:

• Confirmed — no related issue

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.