Hardened SSRF defenses against AWS ECS task metadata
(`169.254.170.2`, `169.254.170.23`), Tencent Cloud (`169.254.0.23`),
and AlibabaCloud (`100.100.100.200`) metadata endpoints — these are
now always blocked alongside the existing AWS IMDS / Azure / OCI /
DigitalOcean entry (`169.254.169.254`). Redacted credentials, path,
and query from URL-rejection logs (operators with grep/regex tooling
on the rejection log lines will see authority-only `scheme://host:port`
instead of full URLs going forward).
