fix(#259): validate host in pairing string to prevent SSRF (#344)

Add robust validation for hosts provided through URI or Base64 pairing
strings to prevent Server-Side Request Forgery (SSRF). The application
now rejects loopback addresses (like localhost, 127.0.0.1, 0.0.0.0),
link-local addresses, and any-local addresses, while continuing to allow
remote connections to site-local addresses, custom remote domains,
and VPN networks (like Tailscale). The DNS resolution operates securely
on the IO dispatcher to ensure main-thread safety. Included tests verify
both rejection of invalid hosts and seamless parsing of valid ones.

app/src/test/java/com/m57/hermescontrol/ui/connect/ConnectViewModelTest.kt

@@ -612,12 +612,14 @@ class ConnectViewModelTest {
             val viewModel = ConnectViewModel(mockApp)
             viewModel.onPairingString("hermes://connect?host=192.168.1.1&port=8888&token=abc123")
 
+            // Wait for parsing coroutine to finish
+            advanceUntilIdle()
+
             val state = viewModel.uiState.value
             assertEquals("192.168.1.1", state.host)
             assertEquals("8888", state.port)
             assertEquals("abc123", state.token)
             // Should have triggered connect
-            advanceUntilIdle()
             assertTrue("connection should succeed after pairing", viewModel.uiState.value.connectionSuccess)
         }
 }