v0.45.3

v0.45.3

Security fix, and a correction to v0.45.2. Take this instead of 0.45.2 if you
run the HTTP transport, or if you call operate/fetch on records you did not
publish yourself.

Fixed

• A redirect bypassed the egress guard shipped in 0.45.2. That guard validated
  the URL it was handed, but the HTTP client follows redirects — so a record
  carrying a perfectly PUBLIC URL that 302s to http://127.0.0.1:9200/ reached
  it with the check satisfied. Measured before this fix: the guard was consulted
  once, about the entry URL, while the redirect target was fetched unchecked.

  0.45.2 does block a record pointing DIRECTLY at private address space. It did
  not block the same thing behind one redirect.

  Validation now also runs as an HTTP request event hook, which is the only layer
  that sees every address actually connected to, so it binds each hop rather than
  the first. The call-site checks remain: they fail before any I/O and name the
  file being refused, which a transport-level error cannot.

  After the fix the redirect target receives zero requests.

Unchanged from 0.45.2, and still true: a host that does not resolve is allowed
through, because it points nowhere and refusing it would block offline callers
while closing nothing; and this does not defeat DNS rebinding, which would
require pinning the checked address into the connection itself.