fix(fetchers): enforce rss feed outbound policy

[chaliy]

What

Enforce FetchKit's outbound policy for RSSFeedFetcher, including DNS pinning, private-IP blocking, redirect revalidation, and same-host redirect enforcement.

Closes #93.

Why

RSSFeedFetcher built its own redirect-following client and bypassed the hardened request path, which allowed loopback/private targets and cross-host redirects to slip past the documented SSRF protections.

How

• route RSS requests through the shared manual-redirect request helper used by the default fetcher
• keep the RSS-specific accept header and timeout while applying policy checks on every hop
• add security regressions for direct loopback RSS fetches and cross-host redirects via localhost -> 127.0.0.1

Risk

• Low
• RSS requests now use the hardened redirect flow; the main regression risk is feed fetch behavior around redirects and request timeouts

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Specs are up to date and not in conflict