security: research Azure IPv6 IMDS endpoint (if any) and add to SSRF block list

[millerjp]

Summary

#480 adds AWS IPv6 IMDS (`fd00:ec2::254`) to the SSRF block list. Azure's IPv6 IMDS endpoint, if any, was not added because no authoritative Microsoft source could be located during the security review.

A `TODO(#)` comment in `ssrf.go` marks the spot where the Azure literal would go once verified.

Background

• Azure's documented IMDS endpoint is `169.254.169.254` (IPv4-only per current Microsoft Learn).
• The prompt for security: extend SSRF block list to cover AWS IPv6 IMDS and IPv6-mapped IPv4 edge cases #480 listed `fd00:0:0:0:0:0:0:FE` as a candidate Azure IPv6 address, but the security-reviewer agent could not locate an authoritative Microsoft source for it.
• Shipping an unverified literal is worse than omitting it — it implies coverage we don't actually have.

Requirements

1. Check Microsoft Learn and Azure Instance Metadata Service docs for any documented IPv6 endpoint.
2. Check if the Azure IMDS has moved to support IPv6 since 2025.
3. If an endpoint exists, add it to `ssrf.go`'s block list with a citation in the code comment (link to Microsoft docs).
4. If no endpoint exists or is coming, update the `TODO(#)` to a note stating the research was done and no IPv6 IMDS is published.

Acceptance Criteria

1. `ssrf.go` either has an Azure IPv6 metadata literal with a citation, OR a negative note ("verified 2026-MM-DD: no Azure IPv6 IMDS is published") that supersedes the TODO.
2. If added: unit test `TestCheckSSRFIP_BlocksAzureIPv6Metadata` asserting the rejection.
3. If added: BDD scenario in `tests/bdd/features/ssrf_protection.feature` for the Azure vector.
4. `SECURITY.md` and `docs/webhook-output.md` / `docs/loki-output.md` block-list references updated.

Testing Requirements

• Unit test (if added): `TestCheckSSRFIP_BlocksAzureIPv6Metadata`.

Documentation Requirements

• `SECURITY.md` SSRF section.
• `docs/webhook-output.md` block-list table.
• `docs/loki-output.md` block-list list.

Dependencies

• Blocked by: security: extend SSRF block list to cover AWS IPv6 IMDS and IPv6-mapped IPv4 edge cases #480 (introduces the typed SSRFBlockedError scaffold this would plug into).

Related

Parent: #472.