Define and enforce webhook destination policy for hosted and self-hosted deployments #2666

Webhook delivery currently has no public-address restriction. During review of #2628, Eric called out that user-selected destinations and redirects can reach internal services. #2628 deliberately leaves destination policy unchanged and removes the acceptance test that would have made private, loopback, metadata, and credential URLs a supported contract.

Decide the hosted default and an explicit self-hosted opt-out before implementing restrictions. Evaluate reusing the connect-time PublicAddressPolicy introduced for source maps in #2625, while accounting for webhook redirects, DNS changes, and configured proxies.

Acceptance criteria:

• Define allowed schemes, address ranges, credential-bearing URLs, redirect handling, and the self-hosted configuration contract.
• Enforce the selected policy at connection time and on redirect destinations; URL validation alone must not be treated as protection against DNS changes.
• Cover public destinations, loopback/private/link-local addresses, IPv4/IPv6, DNS changes, redirects, and proxy behavior using controlled local fixtures without contacting real internal or metadata services.
• Define behavior for existing hooks that become disallowed, including actionable sanitized diagnostics and whether they are disabled or rejected without delivery.
• Document compatibility and rollout requirements for hosted and self-hosted installations; preserve legitimate private integrations only under the explicitly chosen configuration.

This is separate from #2628's delivery cleanup and telemetry changes. The remaining destination-policy limitation is not fixed by that PR.