[Feat]: Agent card validation hook

### Is your feature request related to a problem? Please describe.

#895 mentions lack of agent card validation on the client which may be used to trigger calls to private URLs when agent card is coming from an untrusted source.

Currently no hooks are provided for such validation, which is especially important for functions like `create_client` and `create_from_url` which support URL fetch.

### Describe the solution you'd like

The SDK should not define the rules of validation and private URLs should not be forbidden as it can be a perfectly valid use case.

UPD: see #1023

### Describe alternatives you've considered

The PR referenced implements such validation unconditionally, however using A2A for internal addresses is a valid scenario.