Block SSRF in webfinger RemoteLookup

RemoteLookup() built a URL straight from the domain part of an
attacker-controlled handle and fetched it, letting a crafted handle
(e.g. user@169.254.169.254) make the server issue requests to private
IPs, loopback, link-local, and cloud metadata endpoints. Requests now
go through a hardened client that validates the actually-resolved IP
at dial time (so DNS rebinding can't bypass it), applied to redirects
too, and rejects malformed handles up front.

This fixes GHSA-wvrr-gx9p-xvxm