Refuse an IPv6 address that holds an internal IPv4 address (closes #297)

The check that keeps pixa from fetching internal addresses read an
IPv6 address as IPv4 only in the mapped form (::ffff:a.b.c.d), so the
IPv4-compatible form, such as ::127.0.0.1, was judged as IPv6 and
passed. An address in ::/96 is now judged by the IPv4 address it holds,
so one holding a private, loopback or link-local address is refused on
both image routes before any upstream request. The NAT64 range
64:ff9b::/96 stays blocked whole, as it was on next.

Model: opus-5-5

internal/httpfetcher/httpfetcher.go

@@ -543,6 +543,13 @@ func isPrivateIP(ip net.IP) bool {
 		return true
 	}
 
+	// An IPv4-compatible IPv6 address (in ::/96, such as ::127.0.0.1) holds
+	// an IPv4 address in its last four bytes and is judged as that address
+	if addr, ok := netip.AddrFromSlice(ip); ok &&
+		netip.MustParsePrefix("::/96").Contains(addr) {
+		return isPrivateIP(ip[12:])
+	}
+
 	// Check for loopback
 	if ip.IsLoopback() {
 		return true