DeepSeek Harness Plugin: dsh-ssrf-guard

`dsh-ssrf-guard` is an SSRF protection function plugin for DeepSeek Harness (DSH). It follows a “deny by default” strategy, using an allowlist mechanism to check the host and scheme of outbound URLs before a request is initiated, blocking loopback addresses and URLs containing credentials. The plugin does not perform DNS resolution or proxy traffic; it only supports invoking the `assertUrlAllowed` tool from code or using `ssrf_check` directly. It allows configuring an allowlist in `cordis.patch.yml` and supports environment variables as a fallback, but cannot protect against DNS rebinding attacks. Requires Node.js 22.14.0+.