Fix SSRF and unsafe artifact path opening guards

[cursor]

Bug and impact

• fetch_url, http_request, and the new browser-fetch URL gate could allow private/local IP literals in bracketed IPv6 forms such as IPv4-mapped loopback, enabling agent tool SSRF against local services.
• Artifact citation clicks passed model-supplied paths to open_path, which accepted absolute paths and could open files/apps outside the workspace when clicked.

Root cause

• URL validation used host_str() text and reparsed it as IpAddr; bracketed IPv6 literals did not parse through that path, so IPv6-local and IPv4-mapped private addresses escaped the blocklist.
• open_path treated absolute paths as trusted instead of enforcing the artifact contract that paths are workspace-relative.

Fix

• Validate parsed url::Host values directly and classify IPv4, IPv6, IPv4-mapped IPv6, carrier-grade NAT, link-local, loopback, unique-local, multicast, unspecified, documentation, and discard-only literals as blocked.
• Revalidate final response URLs after reqwest redirects for fetch_url and http_request.
• Restrict open_path to workspace-relative paths and verify resolved paths remain inside the workspace.

Validation

• cargo +stable test --manifest-path src-tauri/Cargo.toml agent_tools::tests::
• cargo +stable test --manifest-path src-tauri/Cargo.toml