- **DNS-pinned `safe_fetch_bytes` connections to close the DNS-rebind TOCTOU window (`opencontractserver/utils/safe_http.py`).** `_assert_public_ip` previously validated a host's resolved address(es) and discarded them, so `safe_fetch_bytes` handed httpx the bare hostname — httpx/httpcore would then resolve DNS again, independently, at connect time. A resolver that returned a public address during validation and a private one moments later (a DNS rebind) would have connected past the SSRF guard. `_assert_public_ip` now returns the validated addresses instead of `None`; `safe_fetch_bytes` connects to the FIRST validated address via a new `_DNSPinnedTransport` (an `httpx.HTTPTransport` subclass that rewrites the request URL's host to the pinned IP while keeping the original hostname as the TLS SNI/certificate-verification name and the `Host` header, so certificate validation and vhost routing are unaffected). Each redirect hop gets its own fresh pin — a new host reached via redirect is never pinned to a previous hop's address. `validate_url` keeps its existing signature/behavior (host-only return) for callers that issue their own request afterward (e.g. `federal_register_provider.py`'s step 1, which uses raw `requests` and is documented as not covered by this pin). Regression tests in `opencontractserver/tests/test_safe_http.py` (`TestDNSPinning`, `TestDNSPinningPerHopIndependence`) intercept at the real `httpcore` connection layer and simulate a rebind (first `getaddrinfo` call returns a public address, any further call returns a private one); they fail against the pre-fix code, proving the fix. Closes #2048.
