Refuse an IPv6 address that holds an internal IPv4 address (closes #297)

isPrivateIP read an IPv6 address as IPv4 only in the mapped form
(::ffff:a.b.c.d), so an IPv4-compatible address such as ::127.0.0.1 or
::10.0.0.1 was judged as a public IPv6 address and fetched. An address
in ::/96 is now judged by the IPv4 address in its last four bytes. The
NAT64 range 64:ff9b::/96 is already one of the built-in blocked ranges
and is left as it is.

Model: opus-5-5

internal/httpfetcher/httpfetcher.go

@@ -543,6 +543,13 @@ func isPrivateIP(ip net.IP) bool {
 		return true
 	}
 
+	// An IPv4-compatible IPv6 address (in ::/96, such as ::127.0.0.1) holds
+	// an IPv4 address in its last four bytes and is judged as that address
+	if addr, ok := netip.AddrFromSlice(ip); ok &&
+		netip.MustParsePrefix("::/96").Contains(addr) {
+		return isPrivateIP(ip[12:])
+	}
+
 	// Check for loopback
 	if ip.IsLoopback() {
 		return true