fix: harden HTTP resource fetching against SSRF

[starboyate]

Summary

• Add a secure default HTTP resource fetch policy that validates schemes, hosts, userinfo, and resolved addresses before any outbound request.
• Disable automatic HttpClient redirects and follow redirects manually so each redirect target is revalidated, with redirect-count enforcement and HTTPS-to-HTTP downgrade rejection.
• Add an explicit private-network opt-in while keeping loopback, link-local, multicast, and special-use ranges blocked, and document sourceUrl as untrusted.

Fixes #100

Compatibility

• Custom HttpClient instances passed to HttpResourceFetcher must use HttpClient.Redirect.NEVER; clients with automatic redirects are rejected so redirect targets can be validated safely.

Test Plan

• mvn -pl memind-core -Dtest=HttpResourceFetcherTest,HttpResourceFetchPolicyTest test
• mvn -pl memind-core test
• mvn -pl memind-core spotless:check checkstyle:check