fix(fetchers): validate notebook raw URLs

[chaliy]

Motivation

• Jupyter notebook fetcher rewrites GitHub/GitLab blob URLs to raw-content URLs and then executed the outbound request without re-applying fetch policy, allowing blocked hosts or port restrictions to be bypassed.
• Enforce the same host/port allow/block rules on the rewritten raw destination to close this egress-policy gap.

Description

• Call options.validate_url(&raw_url)?; in JupyterNotebookFetcher::fetch before calling transport_request so the rewritten raw-content URL is validated against blocked_hosts and allowed_ports policies.
• Add regression tests in crates/fetchkit/src/fetchers/jupyter_notebook.rs that inject a CountingTransport to assert the transport is not invoked when the rewritten raw host is blocked or the rewritten port is disallowed.
• Change is minimal and tightens validation only for notebook raw-content requests without altering successful fetch behavior.

Testing

• Ran the new unit tests for the notebook fetcher with cargo test -p fetchkit jupyter_notebook::tests -- --nocapture and they passed.
• Ran the full test suite with cargo test --workspace and all tests passed.
• Verified cargo clippy --workspace --all-targets -- -D warnings, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps, and cargo build --workspace --exclude fetchkit-python --release all succeeded.

---

Codex Task