[Aikido] Add StoredSSRFScanner to libcurl HTTP clients to prevent SSRF bypasses

[aikido-autofix]

This patch mitigates stored Server-Side Request Forgery (SSRF) vulnerabilities in libcurl-based HTTP clients by registering the StoredSSRFScanner across the curb, patron, and typhoeus sinks. The scanner performs explicit DNS resolution before outgoing HTTP requests to enable detection of IMDS (Instance Metadata Service) addresses and other internal network targets that could be exploited through stored SSRF attacks. The fix was applied to lib/aikido/zen/sinks/curb.rb, lib/aikido/zen/sinks/patron.rb, and lib/aikido/zen/sinks/typhoeus.rb.

✅ 1 issue fixed by this PR

Issue	Severity	Description
CodeAudit#811805719	HIGH	Curb's perform hook scans with a sink containing only Scanners::SSRFScanner. That scanner requires a current request context and reports only when the destination matches a payload in that request. StoredSSRFScanner, which independently checks resolved addresses against IMDS ranges and is designed to operate without request context, is registered only on the Resolv and TCPSocket sinks. Curb then invokes the native libcurl operation, bypassing those Ruby resolution/socket hooks. Consequently, an application that uses Curb to fetch a URL obtained from persisted or otherwise non-request-derived data can request an IMDS address without the stored-SSRF protection running. The optional outbound-domain policy is a separate deployment control and is not an inherent prevention for applications using a permissive policy.

[codecov]

Codecov Report

❌ Patch coverage is 77.50000% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
lib/aikido/zen/sinks/patron.rb	64.28%	4 Missing and 1 partial ⚠️
lib/aikido/zen/sinks/curb.rb	85.71%	0 Missing and 2 partials ⚠️
lib/aikido/zen/sinks/typhoeus.rb	83.33%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!