feat: implement outbound DNS rebinding protection

[ugoocreates-pixel]

Closes #1101

Description

This PR implements outbound DNS rebinding protection across the GasGuard repository as part of the production-readiness and long-term maintainability roadmap.

It introduces a custom HTTP/HTTPS agent (createSafeAgent) in src/security/dns.ts that overrides the default dns.lookup function. By validating the resolved IP address before the connection is made, it ensures that outbound requests do not connect to private, loopback, or internal IP addresses (thereby protecting against both DNS rebinding attacks and SSRF).

Changes

• src/security/dns.ts: Added isPrivateIP and createSafeAgent to enforce DNS resolution constraints.
• src/security/dns.spec.ts: Added comprehensive unit tests for normal, boundary, and failure scenarios.
• src/integrations/github/github-client.ts: Updated Axios to use the safe HTTP and HTTPS agents.
• src/simulation/stellar/stellar-rpc-client.ts: Updated Axios configuration to use the safe agents.
• src/modules/gas-spike-alert/webhook-dispatcher.service.ts: Replaced standard fetch with axios using the safe agents to protect outbound webhook dispatches.

Verification

• Unit tests cover normal, boundary, and failure scenarios.
• Interfaces are modular and backward compatible.
• No secrets, keys, or sensitive data are included in these changes.

[drips-wave]

@ugoocreates-pixel Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mijinummi]

Nice work! Well done