fix: (backport) prevent SSRF via redirect following in webhook delivery (#7877)

[Dhruwang]

Summary

• Backport of fix: prevent SSRF via redirect following in webhook delivery #7877 (6d9ab315c) to release/4.9
• Prevents SSRF via redirect following in webhook delivery by adding redirect: "manual" to both fetch sites (pipeline/route.ts and testEndpoint in webhook.ts)
• Rejects 3xx responses with a clear error message in the test endpoint path
• Gated on DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS for self-hosters who explicitly opt into trusting internal URLs

Test plan

• Existing webhook tests pass (pnpm vitest run modules/integrations/webhooks/lib/webhook.test.ts)
• New parameterized redirect rejection tests (301/302/303/307/308) pass
• Manual: "Test Endpoint" with a redirect URL shows clear error in UI

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud