fix(urllib): treat 0.0.0.0/8 and 240.0.0.0/4 as non-public

IsNonPublicIP only rejected the single unspecified address 0.0.0.0
and let the rest of the "this network" block (0.0.0.0/8) through, as
well as the reserved 240.0.0.0/4 block, which includes the limited
broadcast address 255.255.255.255.

Neither block is globally reachable (RFC 6890), so add both to the
list of non-public prefixes used by the fetcher and integration
client private-network guards.

internal/urllib/url.go

@@ -17,10 +17,12 @@ var (
 	nat64WellKnownPrefix            = netip.MustParsePrefix("64:ff9b::/96")
 	sixToFourPrefix                 = netip.MustParsePrefix("2002::/16")
 	nonPublicIPPrefixes             = []netip.Prefix{
+		netip.MustParsePrefix("0.0.0.0/8"), // "This network" (RFC 6890).
 		netip.MustParsePrefix("168.63.129.16/32"),
 		netip.MustParsePrefix("192.0.0.192/32"),
 		netip.MustParsePrefix("198.18.0.0/15"),
-		netip.MustParsePrefix("::/96"), // Deprecated IPv4-compatible IPv6 addresses (RFC 4291).
+		netip.MustParsePrefix("240.0.0.0/4"), // Reserved and limited broadcast (RFC 6890).
+		netip.MustParsePrefix("::/96"),       // Deprecated IPv4-compatible IPv6 addresses (RFC 4291).
 		netip.MustParsePrefix("fec0::/10"),
 	}
 )

internal/urllib/url_test.go

@@ -280,6 +280,14 @@ func TestIsNonPublicIP(t *testing.T) {
 		{"Oracle Cloud metadata IPv4", "192.0.0.192", true},
 		{"benchmarking IPv4", "198.18.0.1", true},
 		{"multicast IPv4", "224.0.0.1", true},
+		{"unspecified IPv4", "0.0.0.0", true},
+		{"this network IPv4", "0.0.0.1", true},
+		{"this network IPv4 upper bound", "0.255.255.255", true},
+		{"IPv4-mapped this network", "::ffff:0.0.0.1", true},
+		{"NAT64 this network IPv4", "64:ff9b::1", true},
+		{"6to4 this network IPv4", "2002:0:1::", true},
+		{"reserved IPv4", "240.0.0.1", true},
+		{"limited broadcast IPv4", "255.255.255.255", true},
 		{"unspecified IPv6", "::", true},
 		{"loopback IPv6", "::1", true},
 		{"multicast IPv6", "ff02::1", true},
@@ -294,6 +302,8 @@ func TestIsNonPublicIP(t *testing.T) {
 		{"IPv4-compatible link-local", "::169.254.169.254", true},
 		{"IPv4-compatible public", "::93.184.216.34", true},
 		{"public IPv4", "93.184.216.34", false},
+		{"public IPv4 after this network", "1.0.0.1", false},
+		{"public IPv4 before reserved", "223.255.255.254", false},
 		{"public IPv6", "2001:4860:4860::8888", false},
 		{"NAT64 public IPv4", "64:ff9b::5db8:d822", false},
 		{"6to4 public IPv4", "2002:5db8:d822::1", false},