fix(sandbox): block unspecified addresses in SSRF guards

[johntmyers]

Summary

Treat unspecified IP addresses (0.0.0.0 and ::) as internal/blocked in sandbox proxy SSRF checks.

Related Issue

Closes #592

Changes

• Update is_internal_ip to classify unspecified IPv4/IPv6 as internal.
• Update is_always_blocked_ip to always block unspecified IPv4/IPv6 even when allowed_ips is configured.
• Add regression tests for internal classification, always-blocked classification, and resolve_and_check_allowed_ips rejecting 0.0.0.0.

Testing

• RUSTC_WRAPPER= cargo test -p openshell-sandbox unspecified
• mise run pre-commit (fails due unrelated existing SPDX header issues under architecture/plans/567-*)

Checklist

• Scope limited to issue
• Tests added for regression coverage
• No unrelated files changed