[arike-tech]

Closes #21

Summary

• Reject private, link-local, loopback, unspecified, multicast, broadcast, CGNAT, and IPv4-mapped address literals for remote endpoints.
• Install a guarded DNS resolver so hostnames resolving to internal addresses are refused before connecting.
• Allow only redirects to the original endpoint host, re-validating every hop and the final response URL.
• Document the fail-closed policy in docs/NETWORK_SECURITY.md and update related security/architecture docs.

Tests

• cargo test --workspace --all-features passed.
• cargo clippy -p devkit-rpc --all-targets --all-features -- -D warnings passed.
• Added unit tests for private-range rejection, DNS filtering, same-host redirects, and cross-host redirect refusal.

Security notes

Cross-host redirects now fail closed instead of being silently followed. Loopback endpoints remain usable for local RPC nodes.