CVE-2024-29415 — ip SSRF allowlist bypass

The `ip` npm package — often used to determine whether an IP is 'private' for SSRF defense — could be bypassed by octal / hexadecimal / zero-padded encodings, rendering SSRF allowlists incomplete.