fix(ssrf): guard explicit proxy connections

[wunianze666-netizen]

Summary

• install InvokeAI's guarded HTTP/HTTPS connection pools on Requests proxy managers
• prevent an explicit download_proxy from bypassing the connected-peer SSRF check
• add a regression test using a loopback proxy

Related Issues / Discussions

Refs #9493 (download-queue SSRF follow-up, item 2).

QA Instructions

• Verified the pre-fix behavior locally: an explicit loopback proxy returned HTTP 200 despite the guarded session.
• Verified the new behavior locally: the same request is rejected with UnsafeDownloadURLException.
• python -m ruff check invokeai/app/util/ssrf.py tests/app/util/test_ssrf.py
• python -m ruff format --check invokeai/app/util/ssrf.py tests/app/util/test_ssrf.py
• Python compilation and git diff --check pass.

Merge Plan

This is intentionally limited to the proxy-manager path described in #9493. It does not change the explicit private-download opt-out or the separate injected-session follow-up.

Checklist

• I have performed a self-review of my own code
• I have added or updated focused tests
• I have checked the diff for secrets and unrelated files