fix(fetchers): enforce policy for API subrequests

[chaliy]

Motivation

• Prevent specialized fetchers from issuing secondary API requests that bypass operator egress controls (host, port, allow/block prefix rules) such as requests to https://api.github.com built by the GitHub Actions run fetcher.
• Centralize outbound URL policy so both caller-provided URLs and any hardcoded API subrequests are validated consistently.

Description

• Add a shared validate_policy_url(url: &Url, options: &FetchOptions) helper in crates/fetchkit/src/fetchers/mod.rs that enforces FetchOptions::validate_url plus allow/block prefix checks via url_matches_policy_prefix.
• Replace the registry's inline prefix logic with a call to validate_policy_url when finding a matching fetcher.
• Call validate_policy_url at the start of transport_request in crates/fetchkit/src/fetchers/default.rs so specialized fetchers must pass policy validation before the transport executes any secondary API request.
• Add a regression test enforces_policy_on_api_requests_before_transport in crates/fetchkit/src/fetchers/github_actions_run.rs that asserts API subrequests are blocked with FetchError::BlockedUrl before transport execution.

Testing

• Ran the new unit fetchers::github_actions_run::tests::enforces_policy_on_api_requests_before_transport, which passed.
• Ran cargo test -p fetchkit and cargo test --workspace, both of which completed with all tests passing.
• Ran cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps, and cargo build --workspace --exclude fetchkit-python --release, and all checks completed successfully.

---

Codex Task