fix: various security fixes (#38406)

Addresses a batch of privately reported security issues, grouped by
area:

- **SSRF** - migration PR-patch/asset fetches, OAuth2 avatar & OpenID
discovery, pull-mirror URL re-validation, and the outbound proxy path.
- **Access-token scope** - prevent scope escalation on token creation;
keep public-only tokens confined (feeds, packages, Actions listings,
star/watch lists, limited/private owners).
- **Access control / disclosure** - go-get default-branch leak, webhook
authorization-header leak, watch clearing on private transitions,
label/attachment scoping.
- **Denial of service** - input bounds for npm dist-tags, Debian control
files, Arch file lists, and SSH keys.

### 📌 Attention for site admins

Not breaking - existing configs keep working - but two changes are worth
a look:

- **New SSRF protection** Outbound requests (migrations, OAuth2 avatars,
OpenID discovery, pull mirrors, proxy path) are now validated against
the allow/block host lists. If your instance legitimately reaches
internal hosts, you may need to add them to
`[security].ALLOWED_HOST_LIST` (and the relevant `ALLOW_LOCALNETWORKS`
settings).
- **Deprecation** `[webhook].ALLOWED_HOST_LIST` is deprecated and will
be removed in a future release. Use `[security].ALLOWED_HOST_LIST`
instead; the old key still works for now.

---------

Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

services/migrations/http_client.go

@@ -10,20 +10,33 @@ import (
 	"gitea.dev/modules/hostmatcher"
 	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
-// NewMigrationHTTPClient returns a HTTP client for migration
-func NewMigrationHTTPClient() *http.Client {
+// migrationHTTPClient is the shared migration client. Callers that would otherwise build a client per
+// request use it (via getMigrationHTTPClient) so a single connection pool is reused across downloads —
+// e.g. many release assets from the same host — instead of a fresh pool and TLS handshake each time. It
+// is built lazily on first use and reset by Init whenever the allow/block lists change; OnceValue keeps
+// concurrent callers sharing a single client instead of racing to create their own.
+var migrationHTTPClient = util.OnceValue[*http.Client]{Func: newMigrationHTTPClient}
+
+// newMigrationHTTPClient returns a HTTP client for migration
+func newMigrationHTTPClient() *http.Client {
 	return &http.Client{
 		Transport: NewMigrationHTTPTransport(),
 	}
 }
 
-// NewMigrationHTTPTransport returns a HTTP transport for migration
+// getMigrationHTTPClient returns the shared migration client, building it on first use so no request
+// escapes the SSRF-validated transport even before Init has run.
+func getMigrationHTTPClient() *http.Client {
+	return migrationHTTPClient.Value()
+}
+
+// NewMigrationHTTPTransport returns a HTTP transport for migration. The target is validated against the
+// allow/block lists on both the direct-dial and proxy paths, so a configured proxy cannot be used to
+// reach an otherwise-forbidden target (SSRF).
 func NewMigrationHTTPTransport() *http.Transport {
-	return &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: setting.Migrations.SkipTLSVerify},
-		Proxy:           proxy.Proxy(),
-		DialContext:     hostmatcher.NewDialContext("migration", allowList, blockList, setting.Proxy.ProxyURLFixed),
-	}
+	return hostmatcher.NewHTTPTransport("migration", allowList, blockList, proxy.Proxy(), setting.Proxy.ProxyURLFixed,
+		&tls.Config{InsecureSkipVerify: setting.Migrations.SkipTLSVerify})
 }