Fix resolved URL destination validation

[3em0]

Summary

• normalize bracketed IPv6 hostnames before private address checks
• resolve URL hostnames before fetching and reject any private, loopback, link-local, or reserved destination address
• apply the same destination validation to each manual redirect target

Fixes #112

Testing

• node node_modules/typescript/bin/tsc --noEmit
• temporary compiled smoke test confirmed rejection of http://[::1], IPv4-mapped loopback, 127.0.0.1, and a hostname resolving to 10.0.0.10