Plugin network request restrictions (allowlist)

[Hey-Yetunde]

Problem

Plugins may one day make HTTP calls; today there is no policy limiting where they can connect, inviting SSRF.

Context

The Stellar service already restricts its own outbound URLs. Plugins have no outbound capability yet.

Technical requirements

• Define an allowlist policy for plugin outbound requests (e.g. deny private IP ranges by default, https-only, configurable allowlist).
• Provide a reusable guard function and use it wherever plugin code can trigger network calls.
• Document the policy in docs/security.md.

Acceptance criteria

• The guard rejects non-allowlisted targets and private ranges by default.

Testing requirements

• Unit tests for the guard (loopback, private ranges, non-https, allowlisted hosts).

Dependencies

• None (standalone guard).

Difficulty

Hard

Priority

High