Security: Harden social profile URL checks - refs GHSA-c49g-m2cc-w354

[christianbeeznest]

Fixes GHSA-c49g-m2cc-w354 for the master branch.

• Route social profile favicon checks through SafeHttpClientHelper.
• Block redirects to private/reserved network targets.
• Restore TLS certificate verification.
• Restrict social profile URLs to HTTP/HTTPS.
• Escape the social profile URL before rendering it in href.

Validated with direct SSRF checks:

• Direct loopback request: blocked.
• Public redirect to loopback: blocked.
• Public HTTPS request: allowed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.59%. Comparing base (57f3505) to head (4a7734c).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #9263   +/-   ##
=========================================
  Coverage     15.59%   15.59%           
  Complexity    62009    62009           
=========================================
  Files          2514     2514           
  Lines        232829   232829           
=========================================
  Hits          36303    36303           
  Misses       196526   196526           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.