fix(security): resolve CodeQL code scanning alerts

[FenjuFu]

Summary

• eliminate the DNS-rebinding time-of-check/time-of-use gap in redirect probing by validating and pinning the exact DNS answers used by OkHttp
• bypass system proxies for the security probe so the validated target cannot be resolved independently by a proxy
• add regression coverage for rebinding and restricted-address rejection
• document and suppress two py/weak-sensitive-data-hashing false positives at the source

CodeQL alert disposition

• docs: update README.md #54 java/ssrf (critical): fixed. The connection now uses a per-request DNS implementation that rejects restricted answers and pins the accepted result for the lifetime of the request.
• refactor: standardize environment variable naming conventions #48 py/weak-sensitive-data-hashing (high): false positive. SHA-256 is used as the digest algorithm for HMAC request authentication, not for password storage.
• feat: update console backend dockerfiles #55 py/weak-sensitive-data-hashing (high): protocol-required. The upstream Spark RTASR protocol specifies HmacSHA1(MD5(appid + ts), api_key); appid and the timestamp are protocol metadata rather than stored secrets. See the official API documentation.

The source retains auditable CodeQL rationale. With maintainer approval, false-positive alerts #48, #55, and PR alert #63 were dismissed through the REST API with technical audit comments. The real default-branch alert #54 remains open until this PR is merged.

Validation

• mvn -pl toolkit -am -Dtest=UrlCheckToolTest -Dsurefire.failIfNoSpecifiedTests=false test ? 12 passed
• mvn -pl toolkit -am spotless:check ? passed
• uv run --frozen python -m pytest tests/test_utils.py -q ? 14 passed
• official Spark signature vector ? matched IrrzsJeOFk1NGfJHW6SkHUoN9CU=
• black --check on both changed Python files ? passed
• git diff --check ? passed