Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients

[bill-rich]

Description

Centralizes SSRF egress protection into a new pkg/ssrf package so detectors and downstream consumers (including the thog analyzer guard, see trufflesecurity/thog#7229) share one classification policy and one enforcement mechanism.

pkg/ssrf

• ErrEgressBlocked sentinel, IsNonPublicIP, CheckDialAddress, and GuardDialer.
• The blocked set is broader than the old isLocalIP: adds CGNAT 100.64.0.0/10 (incl. Alibaba metadata), class E, test-nets and other special-use ranges, all multicast, deprecated IPv6 site-local fec0::/10, and IPv6 embeddings of internal v4 targets that To4() does not normalize (IPv4-compatible ::/96, SIIT, 6to4, Teredo, NAT64 local-use).
• The NAT64 well-known prefix 64:ff9b::/96 is handled by extracting and classifying the embedded IPv4 rather than blanket-blocking, so DNS64-synthesized addresses of public IPv4-only endpoints keep working in IPv6-only networks while internal embeddings stay blocked.

WithNoLocalIP

Now installs the guard as a dialer ControlContext hook that checks the resolved address immediately before connect. The previous implementation vetted a LookupIP result and then dialed the hostname again, which a DNS-rebinding resolver could race; the hook runs on the address actually being dialed and re-runs on every redirect hop. ErrNoLocalIP remains as a deprecated alias of ssrf.ErrEgressBlocked so errors.Is call sites keep working.

Behavior changes to be aware of (documented in the godoc):

• Blocking is per resolved address rather than whole-host.
• Any DialContext already set on the transport is replaced, not chained.
• The broadened set means guarded detectors (e.g. Artifactory, Vault) no longer verify against CGNAT/Tailscale-hosted endpoints. Flagging explicitly for review since this changes self-hosted behavior.

Analyzer clients

Analyzers take their endpoints from scanned content, but the clients built in pkg/analyzer/analyzers used bare http.DefaultTransport. They now build on a guarded transport behind an opt-in SetEgressRestriction toggle, default off, so CLI and self-hosted behavior is unchanged. Covers NewAnalyzeClient, NewAnalyzeClientUnrestricted, the rate-limiter fallback, and HttpStatusTest.RunTest.

Checklist:

• Tests passing for the changed packages (go test ./pkg/ssrf ./pkg/analyzer/analyzers ./pkg/detectors); full suite left to CI
• Lint passing (make lint)? (golangci-lint not installed locally; left to CI)

---

Note

High Risk
Changes security-sensitive outbound networking for secret verification and optional analyzer egress; broadened blocking and per-IP semantics can break legitimate checks against CGNAT/private endpoints when guards are enabled.

Overview
Introduces pkg/ssrf as the shared policy for blocking outbound dials to non-public addresses when destinations come from untrusted scan content. Enforcement runs in the dialer ControlContext on the resolved IP immediately before connect (DNS-rebinding and redirect-safe), with a broader blocked set than the old isLocalIP logic (CGNAT, metadata-adjacent ranges, multicast, IPv6 smuggling forms, etc.) and special handling so NAT64 64:ff9b::/96 classifies the embedded IPv4 instead of blanket-blocking DNS64-synthesized public targets.

WithNoLocalIP in detectors now wraps ssrf.GuardDialer instead of pre-resolving with LookupIP; ErrNoLocalIP remains as a deprecated alias of ssrf.ErrEgressBlocked. Documented behavior shifts: per-address blocking (mixed A records can still connect on a public IP) and replacement rather than chaining of custom DialContext.

Analyzer HTTP clients (NewAnalyzeClient, unrestricted variant, rate-limiter fallback, HttpStatusTest.RunTest) build on baseTransport(), which applies the guarded transport only when SetEgressRestriction(true) is called—default off so OSS/self-hosted internal verification is unchanged.

^{Reviewed by Cursor Bugbot for commit 1923347. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Corpora Test Results

No detector regex or keyword changes in this PR. Bench skipped.