fix: harden ManifestServerUrlResolver against SSRF

[PerrierBouteille]

Information

The SDK downloads the manifest server_versions.json from SIMPLECLOUD_SERVER_VERSION_MANIFEST_URL without an SSRF guard.
Any plugin sharing the JVM can make http://127.0.0.1/... or http://254.254.254.254/... fetching and propagate the link to the controller (SSRF relay).

Fix:

• https only, deny private IP, cap redirects/size.

Root cause

• CloudApiOptions.java copies env without validation
• ManifestServerUrlResolver.java OkHttp.newCall(request).execute() with auto redirect and no limit
• InlineBlueprintSupport.java returns the uncommitted link to apiRequest.setServerUrl()

Tests

• ManifestServerUrlResolverTest : add shouldRejectHttpManifestUrl, shouldRejectPrivateDownloadLink, shouldCapRedirects, shouldCapManifestSize.

Btw: https://docs.simplecloud.app/contribute redirect to the github orga page so can't read if their is needs.