[SECURITY] SSRF Vulnerability in firecrawl_crawl Tool (FIRECRAWL-001)

## Security Vulnerability Report

**ID:** FIRECRAWL-001
**Severity:** HIGH (CVSS 8.5)
**CWE:** CWE-918 (Server-Side Request Forgery)

### Description

The `firecrawl_crawl` tool accepts any string as URL without proper URL validation (`z.string()` instead of `z.string().url()`). This allows SSRF attacks against internal services such as 169.254.169.254 metadata endpoints.

### Vulnerability Details

- The `firecrawl_crawl` tool uses `z.string()` for URL validation instead of `z.string().url()`
- This inconsistency between `scrape` tool (which uses proper `z.string().url()`) and `crawl` tool allows arbitrary URL inputs
- Attackers can exploit this to access internal services, cloud metadata endpoints

### Proof of Concept

The vulnerability can be verified by comparing:
- `scrape` tool: uses `z.string().url()` (secure)
- `crawl` tool: uses `z.string()` (vulnerable)

A malicious input like `http://169.254.169.254/latest/meta-data/` would be accepted by the vulnerable tool.

### Recommended Fix

Change the URL validation in `firecrawl_crawl` from `z.string()` to `z.string().url()` to match the secure implementation in the `scrape` tool.

---
*This is a coordinated security disclosure. Please handle appropriately.*

Locate the firecrawl_crawl tool schema and compare its URL field with the scrape tool's schema. Verify that crawl rejects non-URL input and accepts valid URLs, then run the repository's relevant validation or test commands if available.

Written by the indexing model from the issue text.