fix(extension): route API-based extension requests through ssrf_proxy

## APIBasedExtensionRequestor bypasses the SSRF proxy for outbound user-supplied URLs

`api/core/extension/api_based_extension_requestor.py` issues HTTP requests to a user-supplied `api_endpoint` using a raw `httpx.Client`. SSRF protection was conditional on the optional `SSRF_PROXY_HTTP_URL` /`SSRF_PROXY_HTTPS_URL` env vars being configured; when the proxy was not configured the request went straight to the supplied URL.

Every other internal Dify outbound HTTP call (HTTP node, custom tools, MCP, remote file fetchers, moderation, etc.) routes through `core.helper.ssrf_proxy`, which performs URL/DNS validation and blocks loopback, link-local, and metadata destinations. This requestor was the lone exception.

The endpoint is reachable from any logged-in tenant user through `POST /console/api/api-based-extension`, and the same URL is re-validated on every moderation input, moderation output, and external_data_tool query. A tenant can direct the server to internal network addresses on every call.

### Fix

Route the request through `core.helper.ssrf_proxy.make_request`, matching every other internal Dify outbound call. The optional-mounts dance is removed entirely.

Start in api/core/extension/api_based_extension_requestor.py and compare its outbound request path with core.helper.ssrf_proxy.make_request. Remove the optional proxy-mount handling and route the user-supplied api_endpoint through the SSRF proxy. Done when requests from this requestor receive the same URL and DNS protections as other internal Dify outbound calls.

Written by the indexing model from the issue text.