Security: harden PENS remote transport against SSRF

[krista445]

Summary

• Route PENS package downloads and HTTP callbacks through SafeHttpClientHelper so private, loopback, reserved, mapped IPv6, compatible IPv6, NAT64, 6to4, and unresolved targets are rejected at connection time.
• Preserve no-redirect behavior and the 15-second connection limit while retaining the existing 300-second download and 60-second callback totals.
• Stream downloads without buffering, enforce the 100 MB limit from headers and chunks, detect partial or failed writes, and cancel unused or failed responses.
• Remove full package URLs from logs and prevent the callback response body from being consumed.

This closes the IPv4-mapped IPv6 follow-up described by GHSA-2xvw-qqjj-q68r without granting a private-network exception to the current Chamilo host.

Validation

• PHPUnit: 32 tests, 129 assertions
• ECS: clean
• Psalm: no errors on changed files
• PHP syntax checks: clean
• Symfony container lint: clean
• git diff --check: clean