[codex] Block reserved feed IP SSRF targets

[rissrice2105-agent]

Summary

• expand feed-discovery SSRF IP checks to reject additional non-public IPv4 ranges, including documentation, benchmark, multicast, and reserved blocks
• reject additional non-public IPv6 targets such as unspecified, discard-only, benchmark, documentation, link-local, and multicast ranges
• add regression coverage for the newly blocked direct URL targets

Why

The existing feed discovery URL safety check blocked common private and loopback addresses, but several non-public/reserved addresses could still be accepted as fetch targets. This weakens the SSRF guard for feed probing and validation.

Validation

• npm --workspace @logicsrc/plugin-feed-discovery run test
• npm --workspace @logicsrc/plugin-feed-discovery run build
• git diff --check