Potential fix for code scanning alert no. 12: Server-side request forgery

[jamespepper81]

Potential fix for https://github.com/BitSleuthAI/Analyzer/security/code-scanning/12

Best fix: add a dedicated strict sanitizer for pathname and apply it before new URL(...).

• General approach: Normalize and validate untrusted path input before URL construction, then validate canonicalized path after construction.
• Specific change in src/lib/blockchain-api.ts:
  1. Add sanitizeProviderPathname(pathname: string): string near other sanitizers.
  2. In fetchJson, call this sanitizer and use its output in new URL(...).
• Sanitizer behavior:
  • Require non-empty string.
  • Reject absolute URLs (http://, https://, any scheme), protocol-relative (//...), and backslashes.
  • Enforce leading /.
  • Reject raw and percent-encoded dot segments (., .., %2e, %2f, etc.).
  • Return sanitized pathname unchanged for existing valid callers.
• No new imports or dependencies needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.