Harden webhooks outbound URL safety

[andrei-hasna]

Summary

• Disable automatic redirect following for outbound webhooks with manual redirects.
• Add request-time DNS validation that rejects hostnames resolving to private, loopback, link-local, unique-local, metadata, or carrier-grade NAT addresses.
• Expand tests for redirect behavior, direct private/metadata URL bypass attempts, and public-looking hostnames with non-public DNS answers.
• Document DNS rebinding residual risk and prefer environment/secret-manager signing-secret configuration over argv-style usage.

Validation

• bun test connectors/webhooks/src/api/webhooks.test.ts
• bun run --cwd connectors/webhooks typecheck
• bun run --cwd connectors/webhooks build
• bun run typecheck
• bun run secrets:scan:npmrc
• todos redaction scan --file /tmp/open-connectors-d07e5389-staged.diff
• git diff --check

Todos task: d07e5389-ef10-4651-8c3f-43b4fdaedba8

Residual risk: DNS is validated immediately before Bun opens the connection, but a hostname controlled by an attacker can theoretically rebind between validation and connect. The README now narrows the SSRF-boundary claim and recommends fixed allow-lists plus egress controls for high-risk destinations.