Fix SSRF parser-differential bypass (GHSA-g23j-2vwm-5c25). URLs containing
backslash, whitespace, or ASCII control bytes are now rejected upfront by the
SSRF validator and notification-URL validator; hostname extraction switched
from `urllib.parse.urlparse` to `urllib3.util.parse_url` so the validator and
the HTTP client agree on destination by construction. Credit: @Fushuling,
@RacerZ-fighting.
