Extend private-IP guard to 6to4/Teredo addresses

[ChrisJBurns]

Summary

• The private-IP classifier used to guard against SSRF (protecting things like the cloud metadata endpoint) already decodes NAT64-embedded IPv4 targets, but treated two other IPv6 transition address families that follow the same embedding pattern — 6to4 and Teredo — as ordinary public addresses.
• 6to4 (RFC 3056, 2002::/16) is now decoded the same way as NAT64: the embedded IPv4 is extracted and recursively classified, so a 6to4 address encoding a private/loopback/link-local IPv4 is now treated as private, while one encoding a genuinely public IPv4 stays allowed.
• Teredo (RFC 4380, 2001::/32) is blocked wholesale instead of decoded, since its embedded IPv4 is obfuscated via bitwise NOT and can't be reliably decoded from the address alone.
• Added table-driven test cases covering both new address families, including a case proving 6to4 is decoded rather than wholesale-blocked, and a case proving Teredo's obfuscated low bits don't get mistakenly decoded.

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Does this introduce a user-facing change?

No.

Special notes for reviewers

• Consistent with the existing NAT64 handling in the same file: exact/reversible embeddings (NAT64, 6to4) are decoded and recursively classified; embeddings that can't be reliably decoded (the non-/96 NAT64 remainder, Teredo) are blocked wholesale.
• Running the full task test suite surfaces pre-existing, unrelated failures in pkg/plugins/pluginsvc and a git-resolver test — confirmed via testing against main directly that these predate this change and are environment-dependent, not a regression from this PR.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.77%. Comparing base (06940e8) to head (1dc1c0f).

Files with missing lines	Patch %	Lines
pkg/networking/utilities.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6249      +/-   ##
==========================================
+ Coverage   72.70%   72.77%   +0.06%     
==========================================
  Files         742      742              
  Lines       77273    77281       +8     
==========================================
+ Hits        56184    56238      +54     
+ Misses      17131    17066      -65     
- Partials     3958     3977      +19     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.