Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

internal/delivery/client_ssrf_test.go

@@ -18,8 +18,9 @@ func newSSRFTestEngine() *delivery.Engine {
 	log := slog.New(slog.DiscardHandler)
 
 	client := &http.Client{
-		Timeout:   30 * time.Second,
-		Transport: delivery.NewSSRFSafeTransport(),
+		Timeout: 30 * time.Second,
+		Transport: delivery.NewTestGuard().
+			NewSSRFSafeTransport(),
 	}
 
 	return delivery.NewTestEngine(log, client, 1)
@@ -36,8 +37,8 @@ func TestClientForConfig_TimeoutKeepsSSRFGuard(t *testing.T) {
 	engine := newSSRFTestEngine()
 
 	blocked := []string{
-		"http://127.0.0.1/hook",
-		"http://169.254.169.254/latest/meta-data/",
+		loopbackHookURL,
+		metadataURL,
 		"http://[fe80::1]/hook",
 	}