Block CGNAT (RFC6598) and NAT64 (RFC6052) ranges in SSRF guard (#9195)

* Block CGNAT (RFC6598) and NAT64 (RFC6052) ranges in SSRF guard

getCurlResolveInfo() relies on PHP FILTER_FLAG_NO_PRIV_RANGE plus an explicit
PRIVATE_SUBNETS list. PHP's filter does not cover CGNAT 100.64.0.0/10
(RFC6598, used by Tailscale and some corporate/ISP networks) nor NAT64
64:ff9b::/96 (RFC6052, which maps IPv4 addresses incl. 169.254.169.254),
and neither range was in PRIVATE_SUBNETS, so an authenticated user could
still SSRF to those ranges (e.g. Tailscale peers, or NAT64-mapped cloud
metadata). Add both ranges to PRIVATE_SUBNETS.

Repro: filter_var('100.64.0.1', FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE
| FILTER_FLAG_NO_RES_RANGE) returns the IP (allowed); same for
'64:ff9b::a9fe:a9fe'.

Ref: GHSA-hcv2-vrhw-mjq8

* Minor change comments

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

app/Utils/httpUtil.php

@@ -12,10 +12,12 @@ final class FreshRSS_http_Util {
 		'169.254.0.0/16', // RFC3927
 		'0.0.0.0/8',      // RFC5735
 		'240.0.0.0/4',    // RFC1112
+		'100.64.0.0/10',  // RFC6598 (Shared Address Space of Carrier-Grade NAT)
 		'::1/128',        // Loopback
 		'fc00::/7',       // Unique Local Address
 		'fe80::/10',      // Link Local Address
 		'::ffff:0:0/96',  // IPv4 translations
+		'64:ff9b::/96',   // RFC6052 (IPv6 Addressing of IPv4/IPv6 Translators, NAT64)
 		'::/128',         // Unspecified address
 	];
 	/** @var array<string, string[]> $resolve_ok */