feat(clientdomain): add optional private-IP blocking to TOML resolver

[0dillon]

Summary

The client-domain TOML resolver currently enforces HTTPS-only, a 5-second timeout, a 3-hop redirect cap, and a 100 KB body limit. However, it does not block resolution to private/internal IP addresses.

Acceptance Criteria

• Add an optional config boolean to block private IP resolution.
• Update the HTTP client transport to reject internal IPs during DNS resolution.
• Add tests ensuring internal IPs are rejected when enabled.

Tech Stack

Go, net/http