fix(security): SSRF guard, DNS-rebinding mitigation, zip-bomb cap — H3, M2, M4, L1

[rubenvdlinde]

Summary

• H3 ([HIGH] H3: SSRF risk in FeedRefreshService — no private-IP guard, allow-list empty by default #326): FeedRefreshService::isPrivateIpGuarded() enforces HTTPS-only and rejects hostnames that resolve to private/reserved IP ranges (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE), mirroring the existing CalendarWidgetService::validateUrl guard. Called from refreshFeed() before any HTTP request.
• M2 ([MEDIUM] M2: Calendar widget DNS-rebinding TOCTOU — validateUrl resolves once but fetchIcsBody re-resolves #330): CalendarWidgetService::fetchIcsBody re-calls validateUrl() immediately before the Guzzle get() to reduce the DNS-rebinding TOCTOU window. A note documents that full CURLOPT_RESOLVE IP-pinning is the next step.
• M4 ([MEDIUM] M4: ZipArchive memory exhaustion in Confluence import — no per-entry or total expansion cap #332): ArchiveParser::collectEntries() checks statIndex('size') before getFromIndex() — entries > 25 MB are skipped; total HTML bytes are tracked and iteration halts at 100 MB (zip-bomb guard). Constants MAX_ENTRY_BYTES / MAX_TOTAL_BYTES document the limits.
• L1 ([LOW] L1: FeedRefreshService parseFeedBody — explicit safe libxml flags not set #337): simplexml_load_string now passes LIBXML_NOENT in addition to LIBXML_NOCDATA | LIBXML_NONET, explicitly disabling entity substitution for defence-in-depth on older libxml builds.

Test plan

• Feed URL http://169.254.169.254/... rejected with SSRF guard failure reason
• Feed URL http://127.0.0.1/... rejected
• Valid HTTPS public feed URL proceeds normally
• Calendar ICS URL with private IP: validation fails at both validate time and fetch time
• Confluence import with large HTML entries (>25 MB) skips those entries without crashing
• RSS feed with XML entities does not expand them

🤖 Generated with Claude Code