Prevent SSRF via ActivityPub inbox actor/object IRI resolution

resolveIRI() fetched attacker-controlled actor/object IRIs from the
unauthenticated federation inbox endpoint with no restriction on the
destination host, allowing internal network/cloud metadata access
(e.g. 169.254.169.254). Add isPublicIRI() to reject loopback, private,
link-local, and unspecified addresses, and apply it in resolveIRI()
(covering both the actor IRI and the response-controlled
PublicKey.Owner follow-up fetch) and in webfinger.go's RemoteLookup().

Fixes GHSA-7635-vx4w-qww7.