Add positive and safe fixtures for the FastAPI SSRF rule

[malik111110]

Outcome

PF-FASTAPI-SSRF-001 has a focused vulnerable case and a focused safe case so contributors can change it without relying on unrelated pack tests.

Maintainer guidance

Follow the existing helper pattern in internal/sast/frameworks/fastapi/pack_test.go. Keep this task fixture/test-only unless the new safe case exposes a narrowly demonstrated matcher defect. Do not promote rule maturity in this change.

Acceptance criteria

• Add a minimal vulnerable FastAPI route whose request-controlled URL reaches the HTTP client sink.
• Assert the finding ID is exactly PF-FASTAPI-SSRF-001.
• Add a minimal safe case using a constant or an allowlisted/validated destination.
• Assert the safe case produces no PF-FASTAPI-SSRF-001 finding.
• Keep test input free of real tokens, domains, and network calls.
• go test ./internal/sast/frameworks/fastapi -count=1 passes.
• gofmt produces no diff.

Scope

Start with internal/sast/frameworks/fastapi/pack_test.go and use internal/sast/frameworks/fastapi/rules.go as the contract. Refs #7.