Harden remote name lookup against SSRF and private-target resolution

[macterra]

Summary

Remote name@domain DID lookups in Keymaster need stronger SSRF and private-target protections.

Context

PR #251 added remote name resolution via:

• https://<domain>/.well-known/names/<name>

The current hostname guard only blocks a limited subset of private targets.

Risks

• IPv4 link-local targets like 169.254.169.254
• IPv6 loopback/private/link-local literals such as [::1]
• Other reserved/private IP ranges not covered by the current regex
• Potential DNS rebinding if a public hostname resolves to a private IP

Follow-up ideas

• Detect and reject IPv4 and IPv6 literal private/link-local/loopback/reserved ranges
• Consider resolving hostnames and rejecting private/reserved addresses after DNS lookup
• Reuse a shared outbound URL validation helper if Drawbridge or other services already have one
• Add tests for metadata IPs, loopback, link-local, and IPv6 literal cases

Related

• PR Add remote dmail name resolution #251
• Copilot review comment on isPrivateHostname() in packages/keymaster/src/keymaster.ts