feat(security): validate presigned URLs for skip-auth transport

[smekcio]

Summary

• add strict presigned URL validation for absolute skip_auth=True requests
• enforce HTTPS by default
• block localhost/loopback/private-reserved IPs unless explicitly allowed
• support host allowlist with exact and subdomain matching

Changes

• Added KsefClientOptions fields:
  • strict_presigned_url_validation
  • allowed_presigned_hosts
  • allow_private_network_presigned_urls
• Added request-time validation in sync/async HTTP clients for absolute pre-signed URLs used with skip_auth=True
• Added unit tests for allow/reject/allowlist scenarios
• Updated docs (configuration, errors)

Validation

• python -m pytest -q
• Result at submission time: 406 passed, 4 skipped