Pin SSRF guard IPv6 IPv4-site-local bitmask edges

[groupthinking]

Add boundary tests to ensure SSRF guard IPv6 bitmask ranges for fec0::/10 and 100::/64 reject both edges correctly.

[linear-code]

GRV-410

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• GRV-401
• SSRF guard: neither IPv6 bit-mask range has its boundaries pinned #1520

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Duplicate of #1520, which covers exactly this scope (pinning both edges of the fec0::/10 and 100::/64 IPv6 bit-mask ranges in the SSRF guard). #1520 was closed as completed via #1512, merged ~15s before this issue was opened. Closing as a duplicate.

---

Generated by Claude Code