Bug: Critical Security Vulnerabilities and Bugs in Ollama API Integration

## Describe the issue

This report outlines **critical security vulnerabilities and functional bugs** found in the Ollama language model integration—specifically within the `_ollama_query` method in `langextract/inference.py`.

### Identified Issues:

- **Security Vulnerability – SSRF (Server-Side Request Forgery):** URLs were constructed via raw string concatenation, making the system vulnerable to SSRF attacks.
- **Bug – Typo in Parameter Name:** The incorrect parameter `num_thread` was used instead of the correct `num_threads`.
- **Bug – Incorrect Variable Used in API Call:** `model_url` was mistakenly used in `requests.post()` instead of the constructed `api_endpoint`.
- **Bug – Potential Double-Slash in URLs:** Improper URL concatenation could lead to malformed paths (e.g., `//api/generate`).

---

## Expected Behavior

The Ollama API integration should:

- Properly validate URLs, allowing only `http` and `https` schemes and ensuring the presence of a hostname.
- Pass the `num_threads` parameter correctly to the Ollama API.
- Make requests to the appropriate `/api/generate` endpoint.
- Construct URLs safely to avoid double slashes.

---

## Actual Behavior

- SSRF vulnerabilities were possible due to unvalidated URLs.
- The thread count parameter was ignored due to a typo.
- API requests were made to the base URL instead of `/api/generate`.
- Malformed URLs were generated in certain configurations.

---

## Steps to Reproduce

1. **SSRF Vulnerability:**
- Inspect `_ollama_query` in `langextract/inference.py` before the fix.
- Pass a malicious URL (e.g., `file:///etc/passwd`, `http://internal-service.local`) via `model_url`.
- Observe that the URL is accepted and processed.

2. **Typo in Parameter:**
- Look for `options['num_thread']` instead of `options['num_threads']`.
- The Ollama API ignores the invalid parameter.

3. **Incorrect API Call:**
- `requests.post()` uses `model_url` instead of `api_endpoint`.

4. **Double-Slash URLs:**
- If `model_url` ends with `/`, concatenation without `urljoin()` results in malformed URLs like `//api/generate`.

---

## Additional Context

**Fixes Implemented:**

- Added URL validation using `urllib.parse`:
- Ensures scheme is `http` or `https`.
- Ensures hostname is present.
- Replaced `num_thread` with correct `num_threads`.
- Updated `requests.post()` to use `api_endpoint`.
- Replaced string concatenation with `urljoin()` for robust URL building.

These improvements resolve major security flaws and enhance API behavior.