Library: URL items get a reference artifact but are never fetched (WebFetcherProcessor)

[jaylfc]

Split out of #2062 so the in-code deferral has a real tracking number.

Today library_pipeline.py gives url:youtube and url:web items a reference artifact and marks them ready without fetching anything. That is a deliberate P1 boundary, not a bug, but the code comment currently points at no issue (it briefly cited #2063, which is a merged release PR rather than a tracker item).

Scope when picked up:

• A WebFetcherProcessor that actually retrieves the page or video metadata for URL items.
• SSRF hardening on the fetch path. This is the same class as Userspace install source_url fetch: DNS-rebinding/TOCTOU SSRF hardening (pin validated IP) #971 (DNS-rebinding/TOCTOU on userspace install source_url) and must not be re-solved independently.
• Decide what ready means for a URL item that has been fetched versus one that has only a reference artifact, so status is not misleading.

Blocked by nothing; naturally follows the Library P2 ingestor work (#2059).