feat: SSRF and ReDoS payloads in argument fuzzer

[ksek87]

Problem

The argument fuzzer (fuzzer/argument.rs) covers 8 injection categories (path traversal, command injection, SQL, LDAP, NoSQL, format string, template injection, XML) but is missing two high-value classes documented in real MCP server attacks:

SSRF (Server-Side Request Forgery)

VIPER-MCP (arXiv:2605.21392) scanned 39,884 MCP server repos and found SSRF as one of the three most common vulnerability classes — MCP servers commonly act as HTTP proxies where a url argument is user-controlled. Common bypass patterns that evade naive allowlists:

• Protocol schemes: file://, gopher://, dict://, ftp://, jar://
• Cloud metadata endpoints: 169.254.169.254, fd00:ec2::254, metadata.google.internal
• Localhost bypass variants: 0.0.0.0, [::], 127.1, 2130706433 (decimal IP), 0x7f000001 (hex)
• URL encoding bypasses: http://127.0.0.1%20@evil.com, http://evil.com#@127.0.0.1

ReDoS (Regex Denial of Service)

If a tool's inputSchema declares a "pattern" constraint, the server's regex engine validates inputs against it. Catastrophic backtracking payloads against vulnerable patterns can cause per-request CPU exhaustion. fuzzd already reads inputSchema — it should generate ReDoS payloads targeted at declared patterns.

Acceptance criteria

SSRF

• Add ssrf payload category to ArgumentFuzzer with the URL variants above
• Apply to string fields with names suggesting URL input: url, endpoint, uri, href, link, src, host, target
• Add SsrfAttempt case label for these fuzz cases

ReDoS

• When a string field has "pattern": "<regex>", generate (a+)+b-style catastrophic backtracking payloads against that specific regex
• Detect server timeout/hang response as a finding (leverage existing protocol fuzzer's timeout classification)
• Label as ReDoSAttempt with the specific pattern being probed

Tests

• Unit test: SSRF payloads generated for url-named string fields
• Unit test: ReDoS payload generated when inputSchema includes a pattern field

References

• VIPER-MCP SSRF findings: https://arxiv.org/abs/2605.21392
• Auditing MCP Servers for Over-Privileged Tool Capabilities (eBPF): https://arxiv.org/html/2603.21641v1