Bugfix/ssrf s3 endpoint validation

[aybanda]

Prevent SSRF via S3 Endpoint Validation in Storage Configuration

Summary

This PR fixes a Server-Side Request Forgery (SSRF) vulnerability in the storage configuration logic by validating the S3 endpoint before instantiating the S3 client. Only allow-listed, trusted S3 endpoints are now permitted.

What Was Changed

• Introduced an allow-list (ALLOWED_S3_ENDPOINTS) in s3-helper.ts for trusted S3 endpoints (e.g., official AWS S3 endpoints).
• Added a validation function (isAllowedS3Endpoint) to check the endpoint against the allow-list.
• If a user attempts to configure a storage with an untrusted or attacker-controlled endpoint, the backend now throws an error and refuses to connect.

Security Impact

• Prevents the backend from making requests to arbitrary or attacker-controlled URLs, blocking SSRF attacks.
• Limits S3 endpoint usage to only those explicitly trusted by the platform.

How to Adjust

• To support additional trusted S3-compatible providers, add their endpoints to the ALLOWED_S3_ENDPOINTS array in s3-helper.ts.

---

Closes #186

This patch closes a high-severity SSRF vector and aligns with best practices for secure cloud storage integrations.