v0.2.3

One security fix.

web_fetch resolved the host to validate the address, then let the connection resolve it again independently, so a zero-TTL rebinding record could answer public to the check and private to the connection. The host is now resolved once and the socket is pinned to that validated address; SNI and the Host header stay the real hostname, so TLS and virtual hosts are unaffected. This closes the last item in SECURITY.md's known limitations.