fix: resolve gosec SSRF findings and formatting issues

Validate webhook/ntfy URLs at Service construction time and add
targeted nolint directives for pre-validated URL usage.
Fix goimports formatting in tlscheck_test.go.

internal/tlscheck/tlscheck_test.go

@@ -41,7 +41,7 @@ func TestCheckCertificateValid(t *testing.T) {
 	defer srv.Close()
 
 	checker := tlscheck.NewStandalone(
-		tlscheck.WithTimeout(5 * time.Second),
+		tlscheck.WithTimeout(5*time.Second),
 		tlscheck.WithTLSConfig(&tls.Config{
 			//nolint:gosec // test uses self-signed cert
 			InsecureSkipVerify: true,
@@ -110,7 +110,7 @@ func TestCheckCertificateContextCanceled(t *testing.T) {
 	cancel()
 
 	checker := tlscheck.NewStandalone(
-		tlscheck.WithTimeout(2 * time.Second),
+		tlscheck.WithTimeout(2*time.Second),
 		tlscheck.WithPort(1),
 	)
 
@@ -126,7 +126,7 @@ func TestCheckCertificateTimeout(t *testing.T) {
 	t.Parallel()
 
 	checker := tlscheck.NewStandalone(
-		tlscheck.WithTimeout(1 * time.Millisecond),
+		tlscheck.WithTimeout(1*time.Millisecond),
 		tlscheck.WithPort(1),
 	)