fix(security): URL import with own range check and a generic error (audit M3, cheap part)

PublicAddress blocks every private/reserved IPv4 and IPv6 range
(169.254/16, 100.64/10, fc00::/7, fe80::/10, IPv4-mapped/NAT64/6to4 by
their embedded address, ...) independent of the core version; checked
before the request and on every redirect (Requests before_redirect).
Network failures return only "Die Datei konnte nicht geladen werden.";
the detail goes to the error log. DNS-rebinding pinning stays deferred.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Stubs/RequestsException.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WpOrg\Requests;
+
+// Minimal stand-in for the Requests library's exception (WordPress core ships the real one);
+// WP_Http::request() turns it into a WP_Error.
+if (! class_exists(Exception::class)) {
+    class Exception extends \Exception
+    {
+        public function __construct(string $message, protected string $type = '', protected mixed $data = null, int $code = 0)
+        {
+            parent::__construct($message, $code);
+        }
+
+        public function getType(): string
+        {
+            return $this->type;
+        }
+    }
+}