fix(fetch): block private network URL fetches

[kgarg2468]

Summary

• validate fetch URLs use http/https and resolve only to public IP addresses
• block localhost, private, loopback, link-local, and metadata-service targets
• follow redirects manually so redirected targets are validated before each request

Fixes #4143.

Tests

• cd src/fetch && uv run pytest tests/test_server.py -q
• cd src/fetch && uv run ruff check src/mcp_server_fetch/server.py tests/test_server.py
• git diff --check

[desledishant10]

Thanks for picking this up so quickly, @kgarg2468 really appreciate it.
The fix addresses everything the original disclosure asked for (scheme allowlist + reserved-range denylist), and the per-redirect validation is a nice catch I hadn't explicitly called out. Without it, an attacker could host a public URL that 302s to http://169.254.169.254/... and bypass the initial host check. Glad to see it covered here.
Happy to spin up the same EC2 reproduction setup against this branch to confirm the metadata-service request now refuses cleanly, if that would be useful for the review. Let me know.
Tracking the PR alongside the original disclosure record at https://github.com/desledishant10/mcp-scan/blob/main/disclosures/2026-05-12-mcp-fetch-http-request-ssrf.md so the timeline stays public.