feat(cli): --allow-private-network for localhost development (#33) (#203)

Picks up @Timtech4u's PR #33, which has been waiting since April. The
  design (CLI flag + threading through BrowserContext + http client) is
  theirs and is correct; this is a clean rewrite on top of current main
  because repeated rebase rounds had been reverting unrelated work that
  landed in the meantime.

  Issue #4 blocked all loopback / RFC1918 / link-local fetches to prevent
  SSRF. The only escape was OBSCURA_ALLOW_PRIVATE_NETWORK=1, which is
  process-wide and clunky in pipelines. Multiple users (@Timtech4u in
  the original PR, then @duartemvix and @necrogami in the comment
  thread) reported they cannot use obscura for development against
  http://localhost:N without it.

  Adds --allow-private-network as a global CLI flag, works on fetch,
  serve, and scrape. Threads through BrowserContext::with_storage_and_network
  and the http client's validate_url. CdpContext gets a new_full
  builder and obscura_cdp::start_with_full_serve_options entry point so
  'obscura serve --allow-private-network' lets Puppeteer/Playwright
  navigate to localhost too. Default remains blocked.

  Backward compat: the env var still works (OR'd with the flag inside
  validate_url). All existing constructors and entry points unchanged.

  Verified end-to-end against a local http.server on 127.0.0.1: fetch
  and CDP Page.navigate both blocked by default, both succeed with the
  flag. Public URLs unaffected. Integration suite 28/28, full workspace
  cargo test all green.

crates/obscura-cdp/src/dispatch.rs

@@ -74,7 +74,7 @@ impl CdpContext {
         user_agent: Option<String>,
         storage_dir: Option<std::path::PathBuf>,
     ) -> Self {
-        Self::_new_inner(proxy, stealth, user_agent, storage_dir, false)
+        Self::_new_inner(proxy, stealth, user_agent, storage_dir, false, false)
     }
 
     pub fn new_with_security(
@@ -83,7 +83,22 @@ impl CdpContext {
         user_agent: Option<String>,
         allow_file_access: bool,
     ) -> Self {
-        Self::_new_inner(proxy, stealth, user_agent, None, allow_file_access)
+        Self::_new_inner(proxy, stealth, user_agent, None, allow_file_access, false)
+    }
+
+    /// Kitchen-sink constructor that also threads `allow_private_network`
+    /// (issue #33). Older `new_with_*` builders stay as-is.
+    pub fn new_full(
+        proxy: Option<String>,
+        stealth: bool,
+        user_agent: Option<String>,
+        storage_dir: Option<std::path::PathBuf>,
+        allow_file_access: bool,
+        allow_private_network: bool,
+    ) -> Self {
+        Self::_new_inner(
+            proxy, stealth, user_agent, storage_dir, allow_file_access, allow_private_network,
+        )
     }
 
     fn _new_inner(
@@ -92,23 +107,16 @@ impl CdpContext {
         user_agent: Option<String>,
         storage_dir: Option<std::path::PathBuf>,
         allow_file_access: bool,
+        allow_private_network: bool,
     ) -> Self {
-        let mut ctx = if let Some(ref dir) = storage_dir {
-            BrowserContext::with_storage_full(
-                "default".to_string(),
-                proxy,
-                stealth,
-                user_agent,
-                Some(dir.clone()),
-            )
-        } else {
-            BrowserContext::with_full_options(
-                "default".to_string(),
-                proxy,
-                stealth,
-                user_agent,
-            )
-        };
+        let mut ctx = BrowserContext::with_storage_and_network(
+            "default".to_string(),
+            proxy,
+            stealth,
+            user_agent,
+            storage_dir,
+            allow_private_network,
+        );
         ctx.allow_file_access = allow_file_access;
         let default_context = Arc::new(ctx);
         // Pre-seed with the default-frame execution context ids that