feat: validate proxy targets during signing and proxy fetch

internal/playback/handler/proxy_request.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"mal/internal/observability"
+	"mal/internal/playback/proxytarget"
 	netutil "mal/pkg/net"
 	"net/http"
 
@@ -11,6 +12,10 @@ import (
 )
 
 func newProxyRequest(ctx context.Context, targetURL string, referer string) (*http.Request, error) {
+	if err := proxytarget.Validate(targetURL); err != nil {
+		return nil, fmt.Errorf("validate proxy target %q: %w", targetURL, err)
+	}
+
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, targetURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("build proxy request for %q: %w", targetURL, err)