[Security] SSRF via unrestricted proxy endpoint (proxy.go:119)

## Security Vulnerability Report

A Server-Side Request Forgery (SSRF) vulnerability exists in the proxy endpoint (`proxy.go`, line 119). User-controlled URL from JSON body is passed directly to `http.NewRequest()` without validation.

**Impact:** Cloud credential theft, internal network access.
**CVSS:** 7.7 (HIGH)

Full details sent to prithvi@h2o.ai and support@h2o.ai.

I am happy to provide more details or coordinate a fix.

Start by reading proxy.go around line 119 and tracing how the JSON URL reaches http.NewRequest in the proxy endpoint. No test file or remediation is named, so first identify existing proxy security tests and validation conventions. Done means the reported unrestricted SSRF path is prevented and regression coverage verifies the restriction.

Written by the indexing model from the issue text.