fix(locksmith): block private URLs for Apple Wallet pass thumbnails

[SashaMIT]

Summary

Sibling of #16593 (WebSub hub.callback SSRF). createAppleWalletPass fetches lock metadata.image via bare fetch while generating a pass for unauthenticated GET /v2/pass/.../ios. A lock manager can point image at a private/link-local URL and make Locksmith request it.

This reuses assertSafeCallbackUrl (same helper as #16593) before the thumbnail download and sets redirect: 'error' so a 3xx cannot bypass the host check.

If #16593 merges first, rebase will drop the shared util add and keep only the pass call-site. If this merges first, #16593 can reuse the util as-is.

Test plan

• npx vitest run __tests__/utils/safeCallbackUrl.test.ts (3 passed)
• Confirm pass generation still works with a public https thumbnail

Made with Cursor

[cla-bot]

Thank you for your pull request and welcome to Unlock! We require contributors to sign our Contributor License Agreement, and we don't seem to have the users @SashaMIT on file.
In order for us to review and merge your code, please open another pull request with a single modification: your github username added to the file .clabot.
Thank you!

[vercel]

@SashaMIT is attempting to deploy a commit to the Unlock Protocol Team on Vercel.

A member of the Team first needs to authorize it.

[SashaMIT]

CLA sign PR opened per cla-bot: #16596 (single-file .clabot add for SashaMIT). Once that merges, verification/cla-signed should clear on this PR. Vercel authorize remains maintainer-side.