Keep the SSRF-safe transport in clientForConfig (closes #69) (#74)

`clientForConfig()` in `internal/delivery/engine.go` built a fresh `http.Client` without a Transport when a per-target timeout was configured, dropping the request-time private-IP guard for that path.

It now reuses the shared client's SSRF-safe transport (`e.client.Transport`, the same `NewSSRFSafeTransport` instance), overriding only the `Timeout`. Behaviour is unchanged when no per-target timeout is set (the shared client is returned as before), so no engine code path makes an outbound target request with a client lacking the SSRF-safe transport.

Adds a delivery-package test proving a client from `clientForConfig()` with a per-target timeout still refuses private/reserved/link-local destinations, that the timeout is applied, that the SSRF-safe transport is reused (not duplicated), and that the no-timeout path returns the shared client unchanged.

Confined to `internal/delivery/` only; handlers and server code untouched.

Closes #69

Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #74
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/delivery/engine.go

@@ -1713,10 +1713,15 @@ func (e *Engine) clientForConfig(
 	cfg *HTTPTargetConfig,
 ) *http.Client {
 	if cfg.Timeout > 0 {
+		// Reuse the shared client's SSRF-safe transport so
+		// a per-target timeout does not drop the
+		// request-time private-IP guard. Only the timeout
+		// is overridden.
 		return &http.Client{
 			Timeout: time.Duration(
 				cfg.Timeout,
 			) * time.Second,
+			Transport: e.client.Transport,
 		}
 	}