OWASP hardening for Trace and claim registry

[WejdanBa-CS]

Summary

• Add \lib/core/safe_url.dart\ to block SSRF targets (localhost, RFC1918, link-local, metadata) and credential-bearing URLs
• Apply validation to Trace scans, watchlist, social media resolver, and optional claim registry
• Cap Trace scans at 40/hour per device session
• Expand SECURITY.md with OWASP control matrix

Test plan

• \lutter test\ (77 passed)
• Manual: try tracing \http://127.0.0.1\ — should show validation error
• Manual: optional registry with private URL should be ignored

Made with Cursor