ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

The ip-address dependency need a bump to resolve this CVE:

<img width="1223" height="940" alt="Image" src="https://github.com/user-attachments/assets/d3a503ff-3ed3-4121-b1ec-6c450df0238e" />

The patched version is: 10.3.1