[emmanuelgautier]

Closes #11.

Adds the ssrf category (two aggressive-suite checks, run only with --aggressive) detecting whether the reverse proxy honors absolute-form request-targets and forwards to arbitrary hosts. Introduces a small raw-HTTP probe (ssrfprobe) since net/http only emits absolute-form targets in forward-proxy mode.

• ssrf.open_forward_proxy — sends GET http://example.com/ and confirms open-relay/SSRF behaviour only when the proxy returns that domain's content (which the backend never serves). Uses IANA's reserved example domain; the scanner never contacts it directly.
• ssrf.internal_target_access — reuses the forwarding primitive to probe the proxy's loopback, link-local cloud-metadata endpoints, and private RFC 1918 ranges. Differential and conservative: it learns how the proxy answers an unresolvable forward and flags only internal targets whose response is a success distinct from that baseline; skips entirely when the proxy serves its backend regardless of authority.

Checklist coverage

• Absolute-URI request forwarded to an arbitrary external host
• Access to the proxy's own loopback/localhost interface
• Access to internal/private IP ranges and common internal hostnames
• Port scanning via the proxy — intentionally deferred to a dedicated, separately gated follow-up (most intrusive step, only meaningful post-confirmation; documented in docs/checks/ssrf.mdx)

Includes registration, a category test (open-proxy vs reverse-proxy stand-ins), and a docs page.