CVE-2026-55523: praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

praisonaiagents.tools.web_crawl_tools.web_crawl() validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Client(follow_redirects=True) and does not revalidate redirect targets.

An attacker-controlled public URL can pass the initial host check, redirect to loopback/private/cloud metadata infrastructure, and have the redirected response body returned by web_crawl().

This appears to be an incomplete fix / patch bypass for the published web_crawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160, and GHSA-8f4v-xfm9-3244).