feat: add SSRF sink and source modeling (closes #1177)

[bamiebot-maker]

Summary

Implements Server-Side Request Forgery (SSRF - CWE-918) sink and source modeling across the engine analyzer and scanner worker boundary:

• Runtime Protection (src/security/ssrf.ts):
  • validateUrlForSsrf: Validates scheme (http:, https:), resolves DNS, rejects loopback (127.0.0.0/8), metadata (169.254.0.0/16, metadata.google.internal), private IPv4/IPv6 ranges, and DNS rebinding attacks.
  • preventSsrf: Safe agent wrapper for HTTP/HTTPS requests.
• Engine Analyzer (libs/engine/analyzers/ssrf/):
  • ssrf-001: Detects unvalidated HTTP requests (fetch, axios, http.get, requests.get, urllib) using request-derived targets without safe validation.
  • ssrf-002: Detects weak or bypassable validation patterns (startsWith("http://"), unparsed substring indexOf / includes).
  • ssrf-003: Detects cloud metadata (169.254.169.254, metadata.google.internal) and loopback address access.
  • ssrf-004: Detects disabled TLS verification (rejectUnauthorized: false, verify=False).
• Scanner Worker Boundary (apps/api/src/scanner/ssrf-scan.job.ts):
  • Tenant isolation (organizationId, repositoryId, analysisJobId), safe analyzer runner with timeouts, and idempotent persistence via FindingsService.
• Fixtures & Tests:
  • Unit tests in libs/engine/analyzers/ssrf/ssrf-analyzer.spec.ts & lexer.spec.ts.
  • Worker job tests in apps/api/src/scanner/ssrf-scan.job.spec.ts.
  • Fixture repository tests in tests/fixtures/ssrf/ssrf.repositories.spec.ts.
  • Runtime security tests in src/security/ssrf.spec.ts.
• Documentation:
  • Detailed design and rule definitions in docs/SSRF_ANALYSIS.md.

Closes

[drips-wave]

@bamiebot-maker Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mijinummi]

@bamiebot-maker kindly resolve this.

Thank you.

[drips-wave]

Hey @bamiebot-maker! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#1177	Add SSRF sink and source modeling	Link to this issue
#1179	Add SQL query construction analysis	Link to this issue
#1178	Detect command injection through wrapper APIs	Link to this issue

ℹ️ Learn more about linking PRs to issues