fix(webhooks): reject unsafe outbound URLs

[rissrice2105-agent]

Summary

• add outbound webhook URL validation before storing user-supplied webhook destinations
• reject non-http(s), localhost, local-domain, private IPv4, and private IPv6 targets that would later be fetched server-side
• store the normalized URL after validation

Tests

• node --input-type=module direct validation assertions
• corepack pnpm exec oxlint src/lib/webhooks/url-validation.js src/app/api/webhooks/route.js tests/webhook-url-validation.test.js
• git diff --check

Note: the normal Vitest command is currently blocked locally by the repo's @vitejs/plugin-react/vite package export mismatch: ERR_PACKAGE_PATH_NOT_EXPORTED for vite/internal.