feat: add --hardening-enabled option to limit flux/pkger HTTP requests

[devanbenz]

(port of 2c930fd)

[davidby-influx]

Seem okay to me, but I'd like a review by @jdstrand as the gate

[Copilot]

Pull request overview

This PR adds a server-level “hardening” switch that tightens Flux’s outbound HTTP behavior by swapping in a stricter Flux URL validator, helping mitigate SSRF by preventing Flux HTTP requests to private address space while preserving existing behavior by default.

Changes:

• Introduces FluxDepOption / WithURLValidator and extends NewDependencies(..., fluxOpts...) to allow overriding Flux URL validation + HTTP client together.
• Wires hardening-enabled into influxd startup so Flux dependencies use url.PrivateIPValidator{} when enabled (otherwise url.PassValidator{}).
• Adds configuration documentation (sample TOML) and unit tests covering the option plumbing.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
flux/stdlib/influxdata/influxdb/dependencies.go	Adds Flux dependency options and a WithURLValidator helper; applies options during dependency construction.
flux/stdlib/influxdata/influxdb/dependencies_test.go	Adds unit tests validating WithURLValidator behavior and NewDependencies option acceptance.
etc/config.sample.toml	Documents the new hardening-enabled config option and its effect on Flux HTTP requests.
cmd/influxd/run/server.go	Selects URL validator based on HardeningEnabled and passes it into Flux dependency construction.
cmd/influxd/run/config.go	Adds HardeningEnabled to the root config and includes it in diagnostics output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.