Spike: Shared egress policy

For better SSRF prevention, we should consider enforcing shared requirements/limitations for all outbound HTTP traffic Flagsmith's backend produces, such as:

- resolve first
- reject private, loopback, link-local and CGNAT ranges
- refuse redirects

We must understand which of the above should apply to which of the calls we make, and come up with a policy shared by all `urlopen` calls in the codebase.

Start by inventorying the backend's outbound HTTP calls and every `urlopen` call in the codebase. Review which calls need DNS resolution, private or special-range rejection, and redirect refusal, then document a shared egress policy and its per-call applicability. Done means the policy decisions and affected call sites are identified.

Written by the indexing model from the issue text.