fix(fetchers): enforce release API URL policy

[chaliy]

Motivation

• Prevent a GitHub release fetcher from bypassing operator egress policy by issuing a derived api.github.com request that was not validated against host, port, allow-prefix, and block-prefix rules.
• Ensure operator-configured outbound restrictions apply to both user-supplied URLs and any secondary API URLs derived by specialized fetchers.

Description

• Add validate_secondary_api_url(url, options) to crates/fetchkit/src/fetchers/github_release.rs which calls options.validate_url and enforces allow_prefixes/block_prefixes via url_matches_policy_prefix before transport.
• Invoke validate_secondary_api_url for the derived https://api.github.com/repos/{owner}/{repo}/releases/tags/{tag} URL prior to calling transport_request in the GitHub release fetcher.
• Add unit and async tests to github_release to cover host/port/prefix rejection and to assert that disallowed secondary API URLs are blocked before the transport is executed.
• Update specs/fetchers.md to require that specialized fetchers re-apply host, port, allow-prefix, and block-prefix policy to any secondary URLs they derive.

Testing

• Ran cargo test -p fetchkit github_release and the new/updated tests passed.
• Ran full-suite checks including cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps, and cargo build --workspace --exclude fetchkit-python --release, all of which completed successfully.

---

Codex Task