Slab safeurl

• CVE-2026-77866 Critical 9.0 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts 0.5%
• CVE-2026-77972 Critical 9.0 safeurl validated address is not bound to the request, allowing DNS rebinding 0.3%