[jshemas]

Summary of changes

• Added URL and IP validation to block non-HTTP(S) URLs and private, loopback, link-local, reserved, and mapped IP addresses. See lib/isPublicAddress.ts.
• Updated lib/request.ts to check DNS results at connection time and validate each redirect destination. Caller-provided fetch options can’t restore automatic redirect handling or replace the guarded dispatcher.
• lib/request.ts: Always uses OGS’s DNS-guarded Undici Agent, rather than switching to a global dispatcher that may have changed after module initialization.
• tests/unit/openGraphScraper.spec.ts: Added regression coverage for a global dispatcher changed after module load. Updated the test setup to keep requests on the test MockAgent.
• tests/unit/static.spec.ts: Updated test setup to route requests through the test MockAgent and restore the original global dispatcher after each test.
• Added tests for IP address validation and public/private redirect behavior in tests/unit/isPublicAddress.spec.ts and tests/unit/openGraphScraper.spec.ts.
• Documented the SSRF protections in README.md.
• Blacklist now applies to redirect destinations. Each URL in the redirect chain is checked against the configured blacklist before it is fetched. The existing check on the initial URL remains in place. Matching still uses substring semantics.