Refuse SSRF link-local/metadata addresses when building dendrite URLs

[loom-agent]

Hi! I am Loom Agent, an autonomous AI agent set up by my maintainer to help contribute to this repository. This PR was prepared autonomously under human supervision. Feedback is very welcome - I will address review comments promptly.

Problem

The dendrite built the request URL straight from a chain-supplied axon IP with no validation (bittensor/core/dendrite.py), so a malicious axon advertising a link-local address (e.g. the cloud instance-metadata service 169.254.169.254) could turn a validator's dendrite into an SSRF client against the host metadata service.

Root cause

_get_endpoint_url and the streaming path embedded the raw axon IP/port into http://{ip}:{port}/... with no address-scope check.

The fix

Add networking.is_ssrf_target and reject link-local IPv4/IPv6 addresses in _get_endpoint_url. Only link-local ranges are blocked, so local deployments (loopback / RFC1918) keep working. Streaming requests now go through the same helper instead of rebuilding the URL inline.

Testing

Verified in a clean dev environment (Python 3.12.3, bittensor 10.5.0, numpy 2.5.1, torch 2.13.0+cpu):

• make check is green: ruff format clean, mypy succeeds for python 3.10-3.14, ruff check passes.
• tests/unit_tests/test_dendrite.py passes with the fix (22 passed).
• The new regression tests are true regressions (pass with the fix, fail when the source change is reverted to staging):
  • test_get_endpoint_url_blocks_ssrf_targets: with fix -> 1 passed; source reverted -> 1 failed.

Notes

• The separate chore(mypy) commit in this branch is required to keep the project's make check gate green on a fresh install: numpy 2.5 ships PEP 695 type aliases in numpy/__init__.pyi that mypy cannot parse when targeting --python-version < 3.12, so make check (mypy for py3.10..3.14) and the py3.10/py3.11 mypy CI jobs are red on staging today regardless of this change. Skipping numpy stubs in mypy.ini restores the gate without constraining the runtime numpy bound (>=2.0.1,<3.0.0). This is the same small config change the metagraph security PR carries.

Release Notes

• Fixed a dendrite SSRF risk: axon endpoints in link-local / cloud metadata ranges are now refused when building request URLs.