🛡️ Sentinel: [CRITICAL] Fix SSRF bypass via unvalidated redirects

* 🚨 Severity: CRITICAL
* 💡 Vulnerability: When instantiating `httpx.AsyncClient` in `app/api/url_upload.py`, the `event_hooks` dictionary for the "response" key was assigned twice. The second assignment (`event_hooks={"response": [verify_redirect]}`) overwrote the first (`event_hooks={"response": [validate_redirect]}`). This caused the `validate_redirect` hook to be ignored, degrading the SSRF protection mechanism on redirects.
* 🎯 Impact: Bypassing SSRF protection on HTTP redirects could allow an attacker to make the application issue arbitrary HTTP requests to internal networks or external resources.
* 🔧 Fix: Combined the two event hooks into a single list assignment `event_hooks={"response": [validate_redirect, verify_redirect]}` when instantiating the HTTP client. Added tests to ensure all lines in the modified branch are fully covered.
* ✅ Verification: Verified using the test suite. All tests pass successfully.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/api/url_upload.py

@@ -194,11 +194,10 @@ async def process_url(
         async with httpx.AsyncClient(
             timeout=settings.http_request_timeout,
             follow_redirects=True,
-            event_hooks={"response": [validate_redirect]},
             headers={
                 "User-Agent": "DocuElevate/1.0",  # Identify ourselves
             },
-            event_hooks={"response": [verify_redirect]},
+            event_hooks={"response": [validate_redirect, verify_redirect]},
         ) as client:
             async with client.stream("GET", url) as response:
                 response.raise_for_status()