Cardano Updates

Cherry pick 13.7.1.0

Adds a table-driven Hedgehog property that exercises every classification
branch of isPrivateAddr — IPv4-mapped IPv6 (the SSRF gap fixed in #2132),
native IPv6, and IPv4 — with range-edge cases included to guard against

cardano-db-sync's off-chain pool and vote metadata fetchers reject
URLs whose host or resolved IP is in a private, loopback, or
link-local range as an SSRF mitigation (see parseOffChainUrl and
newRestrictedManager in cardano-db-sync/src/Cardano/DbSync/
OffChain/Http.hs). Local-cluster test setups whose metadata is
served from http://localhost:.../poolN.json or similar therefore
cannot exercise the success path of the fetcher.

This adds an opt-in CLI flag that replaces both layers of the
restriction with a no-op for the duration of the run, intended
for local-cluster testing only. Off by default; the existing
restriction continues to apply to every production deployment.

* New SyncNodeParams field enpAllowPrivateOffChainUrls plumbed
  through SyncOptions (soptAllowPrivateOffChainUrls) into the
  off-chain fetcher threads.
* parseOffChainUrl now takes a Bool: when True the isLocalhostHost
  rejection is skipped.
* newRestrictedManager now takes a Bool: when True it installs a
  permissiveRestriction (addressRestriction returning Nothing for
  every address) instead of offchainRestriction, so DNS-resolved
  private IPs are no longer blocked at connect time either.
* New Hedgehog suite Cardano.DbSync.OffChain.HttpTest covering
  both modes for localhost/127./[::1]/10./192.168. plus a public
  URL and non-HTTP schemes.

Fix offchain issues

cardano-db-sync's off-chain pool and vote metadata fetchers reject
URLs whose host or resolved IP is in a private, loopback, or
link-local range as an SSRF mitigation (see parseOffChainUrl and
newRestrictedManager in cardano-db-sync/src/Cardano/DbSync/
OffChain/Http.hs). Local-cluster test setups whose metadata is
served from http://localhost:.../poolN.json or similar therefore
cannot exercise the success path of the fetcher.

This adds an opt-in CLI flag that replaces both layers of the
restriction with a no-op for the duration of the run, intended
for local-cluster testing only. Off by default; the existing
restriction continues to apply to every production deployment.

* New SyncNodeParams field enpAllowPrivateOffChainUrls plumbed
  through SyncOptions (soptAllowPrivateOffChainUrls) into the
  off-chain fetcher threads.
* parseOffChainUrl now takes a Bool: when True the isLocalhostHost
  rejection is skipped.
* newRestrictedManager now takes a Bool: when True it installs a
  permissiveRestriction (addressRestriction returning Nothing for
  every address) instead of offchainRestriction, so DNS-resolved
  private IPs are no longer blocked at connect time either.
* New Hedgehog suite Cardano.DbSync.OffChain.HttpTest covering
  both modes for localhost/127./[::1]/10./192.168. plus a public
  URL and non-HTTP schemes.

cardano-db-sync's off-chain pool and vote metadata fetchers reject
URLs whose host or resolved IP is in a private, loopback, or
link-local range as an SSRF mitigation (see parseOffChainUrl and
newRestrictedManager in cardano-db-sync/src/Cardano/DbSync/
OffChain/Http.hs). Local-cluster test setups whose metadata is
served from http://localhost:.../poolN.json or similar therefore
cannot exercise the success path of the fetcher.

This adds an opt-in CLI flag that replaces both layers of the
restriction with a no-op for the duration of the run, intended
for local-cluster testing only. Off by default; the existing
restriction continues to apply to every production deployment.

* New SyncNodeParams field enpAllowPrivateOffChainUrls plumbed
  through SyncOptions (soptAllowPrivateOffChainUrls) into the
  off-chain fetcher threads.
* parseOffChainUrl now takes a Bool: when True the isLocalhostHost
  rejection is skipped.
* newRestrictedManager now takes a Bool: when True it installs a
  permissiveRestriction (addressRestriction returning Nothing for
  every address) instead of offchainRestriction, so DNS-resolved
  private IPs are no longer blocked at connect time either.
* New Hedgehog suite Cardano.DbSync.OffChain.HttpTest covering
  both modes for localhost/127./[::1]/10./192.168. plus a public
  URL and non-HTTP schemes.

cardano-db-sync's off-chain pool and vote metadata fetchers reject
URLs whose host or resolved IP is in a private, loopback, or
link-local range as an SSRF mitigation (see parseOffChainUrl and
newRestrictedManager in cardano-db-sync/src/Cardano/DbSync/
OffChain/Http.hs). Local-cluster test setups whose metadata is
served from http://localhost:.../poolN.json or similar therefore
cannot exercise the success path of the fetcher.

This adds an opt-in CLI flag that replaces both layers of the
restriction with a no-op for the duration of the run, intended
for local-cluster testing only. Off by default; the existing
restriction continues to apply to every production deployment.

* New SyncNodeParams field enpAllowPrivateOffChainUrls plumbed
  through SyncOptions (soptAllowPrivateOffChainUrls) into the
  off-chain fetcher threads.
* parseOffChainUrl now takes a Bool: when True the isLocalhostHost
  rejection is skipped.
* newRestrictedManager now takes a Bool: when True it installs a
  permissiveRestriction (addressRestriction returning Nothing for
  every address) instead of offchainRestriction, so DNS-resolved
  private IPs are no longer blocked at connect time either.
* New Hedgehog suite Cardano.DbSync.OffChain.HttpTest covering
  both modes for localhost/127./[::1]/10./192.168. plus a public
  URL and non-HTTP schemes.