fix(fetchers): enforce GitHub commit API URL policy

[chaliy]

Motivation

• The GitHub commit/compare fetcher derived a secondary https://api.github.com:443 URL and sent it via transport_request without re-checking operator FetchOptions policy, allowing an egress bypass of host/port/prefix restrictions.
• Operator-configured allow/block prefixes, blocked_hosts, and allowed_ports must apply to every outbound hop, including API subrequests produced by specialized fetchers.
• Prevent accidental API egress when a deployment allows only an original github.com URL (for example http://github.com:80) but disallows api.github.com:443.

Description

• Add a shared validate_url_policy(url, options) helper in crates/fetchkit/src/fetchers/mod.rs that runs options.validate_url plus prefix and block-prefix checks and return BlockedUrl on violation.
• Replace the registry's inline URL policy logic with a call to validate_url_policy and call validate_url_policy in crates/fetchkit/src/fetchers/github_commit.rs before the transport_request to the GitHub API.
• Add a regression test github_commit_fetcher_enforces_policy_on_api_subrequest in crates/fetchkit/tests/transport.rs and update specs/fetchers.md to document that fetchers deriving secondary API URLs must enforce the same host/port/prefix policy.

Testing

• Ran the focused transport test cargo test -p fetchkit --test transport github_commit_fetcher_enforces_policy_on_api_subrequest which passed and asserts the injected transport received zero calls when policy blocks the API URL.
• Ran the full test suite cargo test --workspace which completed successfully with all tests passing (343 passed reported in this run).
• Verified static checks and artifacts via cargo clippy --workspace --all-targets -- -D warnings, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps, and cargo build --workspace --exclude fetchkit-python --release, all of which completed without errors.

---

Codex Task