fix(security): guard browse.sh skillMdUrl fetches against SSRF

[zapabob]

Summary

• BrowseShSource fetched catalog-supplied skillMdUrl (and the detail endpoint) with raw httpx.get(..., follow_redirects=True), so a malicious CDN URL or redirect hop could reach private/link-local addresses.
• Route both the detail lookup and content download through the existing _guarded_http_get helper (SSRF + hop re-validation), matching the rest of Skills Hub.
• Add a regression test that a private skillMdUrl is refused.

Test plan

• pytest tests/tools/test_skills_hub_browse_sh.py (8 passed)

[teknium1]

Thanks for identifying the unguarded browse.sh path. The premise is confirmed on current main: BrowseShSource.fetch() uses raw redirect-following httpx.get for skillMdUrl at tools/skills_hub.py:3004, and _resolve_skill_md_url() does the same for the detail endpoint at tools/skills_hub.py:3035. Routing both through _guarded_http_get matches its per-hop validation at tools/skills_hub.py:302-337.

Problems

• The test hunk needs current-HEAD adaptation. Commit 39975613b13b418e0eceda178434d7be90ad4f91 removed the BrowseShSource fetch tests that this PR changes, so tests/tools/test_skills_hub_browse_sh.py no longer contains those anchors.

Suggested changes

• During salvage, add the private-skillMdUrl regression as a standalone test in the current BrowseShSource test file, while retaining the production guarded-fetch conversion.

Automated hermes-sweeper review.

[Adolanium]

This is a slice of #63920, not a leftover.

#63920 already routes browse.sh skillMdUrl / detail through _guarded_http_get (and the other hub GETs). Open since Jul 13. This PR is the browse.sh-only cut from Jul 23, with #70334 / #70336 / #70343 doing the same for ClawHub, skills.sh, and GitHub.

"Not merged yet" is not the same as "browse.sh is unguarded." Please don't land this as the browse.sh fix over #63920.

[zapabob]

Closing this as a duplicate of #63920. The latter covers the same BrowseSh skillMdUrl and detail-fetch SSRF paths, uses the current test layout, and also consolidates the shared redirect guard across the related Skills Hub sources. This branch's tests target anchors that no longer exist on current main, so maintaining a second implementation would create unnecessary overlap.