pub async fn assert_public_target(url: &str) -> Result<()>Expand description
Validate that a URL is safe to use as an outbound target: http/https
scheme AND every resolved IP passes the SSRF allow-list. Returns Ok(()) for
a public target, Err for a forbidden one (loopback / link-local / private /
ULA / CGNAT / metadata) or a bad scheme.
Use this to vet a URL before it is stashed and later fetched by a client
that does not itself route through guarded_get — notably an atproto PDS
serviceEndpoint resolved out of a (hostile-controllable) DID document, so a
serviceEndpoint: "http://169.254.169.254/" is rejected at resolve time
rather than reaching a raw XRPC client.