fix(fetchers): validate Crossref API policy

[chaliy]

Motivation

• The Crossref DOI fetcher constructed a derived https://api.crossref.org/works/... URL and dispatched it to the transport without applying the configured egress policy, allowing blocked_hosts or allowed_ports to be bypassed.
• Enforce operator policies for the secondary API hop to prevent unintended egress to api.crossref.org:443 when operators have blocked that host or disallowed that port.

Description

• Validate the derived Crossref API URL with options.validate_url(&api_url)?; before calling transport_request in crates/fetchkit/src/fetchers/crossref.rs.
• Add regression tests blocks_crossref_api_host_policy_before_transport and blocks_crossref_api_port_policy_before_transport to ensure blocked host and disallowed port policies cause FetchError::BlockedUrl for DOI requests.
• Change is policy-only and preserves existing DOI metadata fetching when operator policies allow api.crossref.org:443.

Testing

• Ran cargo test -p fetchkit crossref --lib and the new Crossref tests passed.
• Ran cargo test --workspace and all workspace tests passed (no failures).
• Ran cargo fmt --all -- --check and cargo clippy --workspace --all-targets -- -D warnings and both checks passed.

---

Codex Task