fix: validate magapoke RSS URL before fetch to prevent SSRF

[kentoku24]

Motivation

• Prevent an SSRF vector where the Magapoke adapter would fetch an RSS URL extracted verbatim from a title page HTML, which could point to attacker-controlled or internal hosts.
• Preserve existing behavior of using the canonical RSS URL when the HTML-derived RSS link is missing or untrusted.

Description

• Add scheme/host validation to extract_magapoke_rss_url by importing urlparse, and introducing _ALLOWED_RSS_SCHEMES and _ALLOWED_RSS_HOSTS allowlists.
• Reject extracted RSS URLs whose scheme is not http/https or whose hostname is not in the trusted set, returning None to trigger the existing fallback to canonical_magapoke_rss_url.
• Add two regression tests in tests/test_sources.py to ensure non-HTTP schemes and untrusted hosts in the title page RSS link are ignored and the adapter falls back to the canonical feed URL.

Testing

• Ran PYTHONPATH=. pytest -q tests/test_sources.py -k magapoke which passed with 5 passed, 58 deselected, 1 subtests passed.
• Running pytest without PYTHONPATH=. failed during collection in this environment with ModuleNotFoundError: No module named 'manga_watch', which is an environment setup issue rather than a code regression.

---

Codex Task