prevent HTTP request to internal networks by user content

[blued-gear]

Introduce new HttpClient factory which produces a client that blocks requests to internal and localhost networks using Symfonys NoPrivateNetworkHttpClient decorator.
All HttpClients in the project were replaced with instances produced by this factory.

fixes GHSA-779p-4f7q-pg32
supersedes #2225

[melroy89]

Maybe just two small minor nits..:

1. Transitive dependency used directly, UrlUtils::checkUrlSubpathNotAscending() uses GuzzleHttp\Psr7\Uri/UriResolver, but guzzlehttp/psr7 isn't in composer.json. It's only present transitively via embed/embed. It works today, but a future dependency swap could break it. Consider adding "guzzlehttp/psr7": "^2.x" to require explicitly, agreed? Or do not depend on it ;P
2. Test base class, UrlUtilsTest extends WebTestCase (boots the full kernel) but only calls static methods with no container access needed. EmbedTest in the same directory extends plain PHPUnit\Framework\TestCase -> matching that would make it a true unit test and faster to run.