A Continue resolution that rewrites the request URL applied the new URL
after validate_fetch_url had already run on the original, so a rewrite
could reach a private or internal address the original request was
blocked from. Run the overridden URL back through validate_fetch_url,
matching how redirects are re-validated, and return a blocked response
if it fails.
Also fix a doc comment that ended up attached to the new fetch_response
helper instead of stealth_fetch_all.
SGavrl
bd39512ffb