Add SSRF protection to logo URL fetching

[Copilot]

The fetchLogoAsBase64 function fetches user-controlled URLs from the database without validation, allowing potential SSRF attacks against internal services and cloud metadata endpoints.

Changes

• Added isUrlSafeToFetch validation - Blocks non-HTTP/HTTPS protocols, localhost, private IPv4 ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x, 127.x), and private IPv6 addresses (::1, fe80:, fc00:, fd00:)
• Integrated validation before fetch - Returns undefined for unsafe URLs, causing emails to render without logos rather than exposing internal resources
• Added warning logs - Records blocked URLs with context for security monitoring

const fetchLogoAsBase64 = async (url: string | undefined): Promise<string | undefined> => {
  if (!url) return undefined;

  // Validate URL to prevent SSRF attacks
  if (!isUrlSafeToFetch(url)) {
    logger.warn('Blocked unsafe URL for logo fetch', { url });
    return undefined;
  }

  // ... rest of fetch logic
};

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.