GHSA-5p3m-vhh6-9236

### Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled `delivery_address`. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound SSRF guard, `assert_safe_url()`, which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery. As a result, an authenticated user can configure a webhook destination such as `http://127.0.0.1:9999/ssrf`, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address. ### Details Relevant files: ```text node/src/stigmem_node/routes/subscriptions.py node/src/stigmem_node/subscription_delivery.py node/src/stigmem_node/models/subscriptions.py node/src/stigmem_node/utility/net_util.py SubscriptionCreateRequest accepts delivery_address as a plain string and validates only that it has a minimum length: class SubscriptionCreateRequest(BaseModel): target: str = Field(..., min_length=1) on_change: str = Field(...) delivery_address: str = Field(..., min_length=1) The create route persists this value directly: conn.execute( """INSERT INTO subscriptions (id, subscriber_identity, target, target_kind, on_change, delivery_address, idempotency_key, created_at, tenant_id) VALUES (?,?,?,?,?,?,?,?,?)""", ( sub_id, identity.entity_uri, req.target, target_kind, req.on_change, req.delivery_address, req.idempotency_key, now, identity.tenant_id, ), ) The delivery worker later sends a server-side request to the stored value: with httpx.Client(timeout=10.0) as client: resp = client.post( event["delivery_address"],