[BUG]: Media components bind agent-supplied `url` to `src` with no scheme validation

# Media components bind agent-supplied `url` to `src` with no scheme validation

Repository: https://github.com/a2ui-project/a2ui
Affected: `@a2ui/lit` (verified against published npm release 0.10.3)
CWE: CWE-918 (Server-Side Request Forgery — here client-initiated blind requests) / CWE-20

## Summary

The `Image`, `Video`, and `AudioPlayer` components render `props.url` directly into the `src` attribute of ``/``/`` with no scheme or host validation. The fix for CVE-2026-10032 constrained the `openUrl` *action* to `http(s)`; these media sinks carry the same agent-controlled `url` property but were left unvalidated. Lit escapes the attribute (no markup breakout) and media `src` does not execute script, so this is not direct XSS — but the browser issues a **credential-bearing GET** to whatever URL the agent chooses: internal endpoints (cookie-authenticated blind requests), tracking pixels, and `data:` decoys. This is the a2ui client-side counterpart of the URL-source SSRF reported for the Python/Strands integration (F-02), in the Lit renderer.

## Affected code

- `@a2ui/lit` `src/v0_9/catalogs/basic/components/Image.js:127-132`:

```js
return html ``;
```

- Same pattern: `Video.js:94`, `AudioPlayer.js:86-89`; legacy 0.8 `image.js:150` (and video/audio equivalents)

## Observed behavior

Static verification (verbatim quote above; headless harness has no browser DOM). The `url` value flows from the agent's `updateComponents` message through the binder into the attribute unmediated.

## Impact

An agent renders an invisible media element pointing at an attacker-chosen or internal URL; the victim's browser performs the request with ambient credentials (cookies), enabling internal-endpoint probing, tracking beacons, and UI deception via `data:` content. Confidentiality/Tracking impact beyond availability.

## Suggested remediation

- Validate `url` scheme (`http(s)` only) before binding to `src`, mirroring the CVE-2026-10032 fix for `openUrl`.