fix: SSRF redirect bypass, ReDoS guard, MongoDB filter injection, unbounded caches, panic stack traces

[caiwl]

Security & Reliability Hardening

Fixes all remaining findings from the final review sweep:

1. SSRF redirect bypass (High) — Added CheckRedirect to HTTP clients that validates each redirect target against SSRF rules, blocking open-redirect-based SSRF
2. ReDoS guard (Medium) — Added 1024-char limit on regex resource expressions (Go's RE2 prevents backtracking but long patterns still cost); rejected at policy registration
3. MongoDB filter injection (Medium) — Validated filter field names (alphanumeric+underscore only) and reject target values containing ${}[]
4. Unbounded caches (Medium) — compiledRegexCache capped at 10k entries; FuncResultCache capped at 50k entries
5. Panic stack traces (Low) — All panic recovery blocks now log debug.Stack() for debuggability
6. etcd backoff reset (Low) — consecutiveFails resets after successful watch run
7. Condition length limit (Low) — compileCondition rejects expressions >4096 chars

🤖 Generated with Claude Code