fix(cdp): gate Target.createTarget file:// like Page.navigate

GHSA-q55h-vfv9-qcr5 patched Page.navigate to refuse file:// URLs
unless --allow-file-access was set, but Target.createTarget accepted
the same scheme and called page.navigate(url) directly, bypassing
the policy. A CDP client could call Target.createTarget {url: file://...}
then Runtime.evaluate to read document.body.textContent and recover
arbitrary local files.

Apply the same gate at the Target.createTarget entrypoint. Pull
the file-scheme detector into a shared util module so both domains
stay in lock-step instead of one drifting from the other.

Verified blocked vs the unpatched build (pr69):
  - Patched: Target.createTarget {url: file:///tmp/secret} errors
    "Target.createTarget to file:// is disabled. ..." before any
    navigation runs.
  - Unpatched: same call returns the file contents via
    Runtime.evaluate {expression: "document.body.textContent"}.

crates/obscura-cdp/src/domains/target.rs

@@ -2,6 +2,7 @@ use serde_json::{json, Value};
 
 use crate::dispatch::CdpContext;
 use crate::types::CdpEvent;
+use crate::util::url_is_file_scheme;
 
 pub async fn handle(method: &str, params: &Value, ctx: &mut CdpContext) -> Result<Value, String> {
     match method {
@@ -55,6 +56,17 @@ pub async fn handle(method: &str, params: &Value, ctx: &mut CdpContext) -> Resul
         }
         "createTarget" => {
             let url = params.get("url").and_then(|v| v.as_str()).unwrap_or("about:blank");
+
+            // Same gate as Page.navigate (GHSA-q55h-vfv9-qcr5). Without this,
+            // a CDP client can call Target.createTarget {url:"file:///etc/passwd"}
+            // and then Runtime.evaluate the body off the created target,
+            // bypassing the page-domain check entirely.
+            if url_is_file_scheme(url) && !ctx.default_context.allow_file_access {
+                return Err(
+                    "Target.createTarget to file:// is disabled. Restart with `obscura serve --allow-file-access` to enable.".to_string()
+                );
+            }
+
             let page_id = ctx.create_page();
             let session_id = format!("{}-session", page_id);