* fix: guard data sync and SSO outbound requests against SSRF

Route the GitLab data sync issue fetch and the OpenID Connect well-known
and JWKS fetches through the advocate library instead of plain requests,
so that user/admin configured URLs can't be used to reach Baserow's
internal network. The behaviour is controlled by two new settings,
BASEROW_DATA_SYNC_ALLOW_PRIVATE_ADDRESS and BASEROW_SSO_ALLOW_PRIVATE_ADDRESS,
both defaulting to blocking private addresses.

Also strictly validate the workspace import manifest version before using
it to build a schema file path, preventing path traversal from an
untrusted uploaded archive.

* fix: address review feedback on SSRF guard settings

- Move BASEROW_SSO_ALLOW_PRIVATE_ADDRESS to the enterprise settings module.
- Drop the settings comments that re-explained the env vars.
- Add breaking change changelog entries for both new defaults.
- Cover the blocked private address paths for GitLab data sync and the
  OpenID Connect well-known fetch, and the unknown manifest schema version.

* fix: guard Jira data sync and OAuth2 token/user info fetches against SSRF

The Jira issues data sync passed the user configured jira_url to the
atlassian client, which uses a plain requests session. It now gets an
advocate session gated by BASEROW_DATA_SYNC_ALLOW_PRIVATE_ADDRESS, and a
blocked address becomes a clear sync error.

The OAuth2 token and user info endpoints come from the provider's
well-known document, which the guard on the base URL doesn't constrain.
The OAuth2 session now mounts advocate's validating adapter, gated by
BASEROW_SSO_ALLOW_PRIVATE_ADDRESS.

* fix: parse SSRF guard env vars with str_to_bool

bool(os.getenv(...)) treats "false" and "0" as enabled, which would
silently disable the SSRF guard. Also reword the bug changelog entry to
cover the manifest fix instead of duplicating the breaking change
entries.

* fix: list new SSRF guard env vars in .env.example

* fix: address PR review feedback (#5489)

- default both allow-private-address settings to true for backward compat
- scope the SSO OAuth2 session guard to providers with configurable URLs
- route iCal data sync through the guarded request helper
- clarify blocked-URL errors to mention non-standard ports
- validate import manifest version against supported versions
- use whitelisted ports in private-IP tests so the IP check is exercised

* fix: treat empty SSRF env vars as unset so defaults apply