fix: constrain Slack response posts to allowed host

[saagpatel]

What

• Routes Slack response_url posts through a fixed Slack host after allowlisting the incoming URL.
• Keeps dynamic response_url data limited to the allowed Slack path/query.

Why

• Clears the remaining critical CodeQL SSRF finding after the prior Slack URL validation change.

How

• Converts validated Slack response URLs into relative request paths and uses an httpx client with a constant base URL.

Testing

• uv run ruff check .
• uv run pytest tests/test_slack_ack.py

Performance Impact

• None expected.

Risk / Notes

• Low risk; behavior stays scoped to Slack response_url callbacks, with invalid hosts still skipped.