security: fix open redirect and add small hardening (#1227)

## What this does

Fixes an open redirect plus a handful of small, mostly-invisible
hardening changes around it.

## What's in it

- **The fix**: trailing-slash redirects no longer let `//evil.com/`
redirect off-host.
- **SSRF block** on the DNS/HTTP namespace verification — refuses to
dial loopback, RFC1918, link-local, multicast, CGNAT, or
IP-literal/single-label \"domains\".
- **Slow-client guard**: `ReadTimeout` and `IdleTimeout` on the HTTP
server (no `WriteTimeout` — would risk cutting off legitimate
multi-package publishes).
- **Defence-in-depth headers** on the UI (`/`) and 404 responses.
- **5xx responses** stop leaking raw DB error text to clients (logged
server-side instead).
- **Search filter** stops treating `%` and `_` as wildcards.
- **Validators**: PyPI/NuGet identifiers URL-escaped before fetching;
MCPB no longer follows redirects.
- **Misc**: `Version` field bounded to 255 chars; logs quote user input;
`BlockedNamespaces` denylist now catches subdomain claimants.

Each change is its own commit so they can be reviewed (or reverted)
independently.

## Test plan

- [ ] CI green
- [ ] Synthetic publish in staging for each package type (npm, pypi,
nuget, oci, mcpb) — confirms validator changes don't regress
- [ ] Quick browser check of `/` after deploy to confirm UI still loads
with the new CSP
- [ ] `curl https://<host>//evil.com/` — confirm the open redirect is
closed

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/server_test.go

@@ -232,6 +232,22 @@ func TestTrailingSlashMiddleware(t *testing.T) {
 			expectedLocation: "/v0/servers?limit=10",
 			expectRedirect:   true,
 		},
+		{
+			// Regression test for GHSA-v8vw-gw5j-w7m6: a protocol-relative
+			// path like "//evil.com/" must not redirect off-host.
+			name:             "protocol-relative path should not redirect off-host",
+			path:             "//evil.com/",
+			expectedStatus:   http.StatusPermanentRedirect,
+			expectedLocation: "/evil.com",
+			expectRedirect:   true,
+		},
+		{
+			name:             "path with multiple leading slashes should be collapsed",
+			path:             "///evil.com/foo/",
+			expectedStatus:   http.StatusPermanentRedirect,
+			expectedLocation: "/evil.com/foo",
+			expectRedirect:   true,
+		},
 	}
 
 	for _, tt := range tests {