Harden handler URL fetching and error responses for Reachable shard 4 (CWE-319/918 + error disclosure)

[Copilot]

This PR addresses the selected Reachable critical shard (4 units) in internal/handlers/ai.go, internal/handlers/cve.go, and internal/handlers/suspicious.go. It removes reachable SSRF/plaintext URL paths in FetchTool and eliminates internal error detail leakage in the scoped handlers.

• FetchTool SSRF/TLS controls (internal/handlers/suspicious.go)

  • Added validatedToolURL gate before outbound requests.
  • Enforced absolute https URLs only.
  • Enforced exact URL allowlisting via REACH_FETCH_TOOL_ALLOWED_URLS (comma-separated HTTPS URLs).
  • Normalized URLs for deterministic matching and cached parsed allowlist state.
  • Kept behavior intact for allowed URLs while failing closed when allowlist is unset.

• Error disclosure remediation (internal/handlers/ai.go, internal/handlers/cve.go, internal/handlers/suspicious.go)

  • Replaced http.Error(..., err.Error(), ...) responses in scoped sinks with generic client-safe messages.
  • Preserved diagnostics through server-side logging (log.Printf(...)) instead of returning internals to clients.

• Focused regression coverage (internal/handlers/remediation_test.go)

  • Added targeted tests for:
    • non-HTTPS rejection
    • disallowed URL/path rejection
    • generic fetch failure response (no low-level network details)
    • allowlisted HTTPS success path
    • generic invalid-body handling in SafeAIAnswer
    • safe unsupported-tag response in ParseLanguage

safeURL, err := validatedToolURL(r.URL.Query().Get("url"))
if err != nil {
    http.Error(w, "invalid source url", http.StatusBadRequest)
    return
}
resp, err := http.Get(safeURL)