refactor(component,generic,http): replace env-based URL validation with constructor injection

[pinglin]

To address the PR comment:

Because

• The HTTP component relied on implicit environment variables (GO_TESTING) to control URL validation behavior, making the component's security posture unclear and hard to test
• URL validation logic was scattered and difficult to maintain, with security-critical code mixed with component logic
• The component allowed dangerous localhost access in test mode without explicit configuration
• There was no comprehensive test coverage for the URL validation logic, especially for internal service whitelisting

This commit

• Introduces a URLValidator interface with constructor-based dependency injection, making validation behavior explicit and testable
• Consolidates URL validation logic into a dedicated validator.go file with a unified urlValidator implementation
• Replaces environment variable checks with configurable validator instances (NewURLValidator() for production, NewTestURLValidator() for testing)
• Fixes a critical security vulnerability where test mode implicitly allowed all localhost/127.x.x.x addresses without explicit opt-in
• Adds comprehensive test coverage including production whitelist testing for internal services (pipeline-backend:8081, model-backend:8083)
• Preserves existing security guarantees: production mode only allows publicly available endpoints, blocking private/internal IP addresses
• Maintains backward compatibility while making the component's behavior more explicit and secure
• Consolidates multiple test initialization functions into a single flexible InitForTest() function
• Restores important future work comments about internal service access patterns

[jvallesm]

nit: if elses can be avoided, it tends to improve the code legibility

Suggested change

	if tc.expectBlock {
	c.Assert(err, qt.IsNotNil, qt.Commentf("Should be blocked: %s (%s)", tc.url, tc.reason))
	} else {
	// These might fail due to DNS in test environment, but that's expected
	// The important thing is that the whitelist logic is in place
	if err != nil {
	// If it fails, it should be due to DNS, not whitelist logic
	c.Assert(err.Error(), qt.Contains, "lookup", qt.Commentf("If blocked, should be due to DNS lookup, not whitelist logic"))
	}
	}
	if tc.expectBlock {
	c.Assert(err, qt.IsNotNil, qt.Commentf("Should be blocked: %s (%s)", tc.url, tc.reason))
	return
	}
	// These might fail due to DNS in test environment, but that's expected
	// The important thing is that the whitelist logic is in place
	if err != nil {
	// If it fails, it should be due to DNS, not whitelist logic
	c.Assert(err.Error(), qt.Contains, "lookup", qt.Commentf("If blocked, should be due to DNS lookup, not whitelist logic"))
	}

[jvallesm]

Should we define this in the non-production code (*_test.go files)?

[jvallesm]

note: this validator gives us the possibility to move the the model and pipeline whitelisting away from the CE repo, as it is used only in production.
I'd make the whitelist parameter a constructor param for the validator and then in the program's main.go I'd read the whitelisted hosts from the config, create the URL validator with them and pass it to the component store.

However, I'm fine with having this here out of simplicity and fairness with CE users (they might also want to trigger pipelines or models from other pipelines)

[jvallesm]

nit: I'd put this away from the production code