Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

## Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who controls the authoritative DNS for a hostname they submit can answer the first lookup with a public address and the second with an internal one, so the browser connects to an address the check exists to block. The connection-layer pinning that protects the other fetch paths could not apply here, because the request ran inside the browser rather than through our own HTTP clients. ## Preconditions - `WEB_LOADER_ENGINE=playwright`. This is not the default, and deployments on the default web loader are unaffected. - A reachable Playwright browser, either local or via `PLAYWRIGHT_WS_URL`. - Any authenticated user who can submit a URL for ingestion or trigger a web search. No administrator role is required. - Control of the authoritative DNS for a hostname the attacker submits, serving a short TTL and alternating answers. No timing race is needed, because the two lookups are separate queries the attacker answers differently. - Internal services the browser process can actually reach. A deployment whose browser has no route to internal addresses loses nothing here. ## Impact An authenticated user can make the server read HTTP responses from addresses only it can reach: cloud instance met