🛡️ Sentinel: [HIGH] Fix SSRF in local CLI executor remote forwarding

[rschumann]

🚨 Severity: HIGH
💡 Vulnerability: Server-Side Request Forgery (SSRF) in executeRemote within cli_executor.go. The URL construction allowed potential injection via string manipulation of the path on a dereferenced struct. If an attacker provided an opaque URL, the .String() method could prioritize the Opaque field over the manually modified Path field, bypassing intended constraints.
🎯 Impact: An attacker controlling the remote host input could potentially bypass intended routing, proxying requests to unauthorized internal or external services.
🔧 Fix: Reconstructed the target URL explicitly using a url.URL{} struct literal, strictly assigning only validated components (Scheme, Host, Path, User, RawQuery) to guarantee safe URL generation.
✅ Verification: Ran gosec to confirm the G704 vulnerability is mitigated in this code path, and ran go test ./... -short to ensure no functional regressions. Note: gosec may still flag residual false positives due to taint analysis design, but the structural reconstruction mitigates the risk.

---

PR created automatically by Jules for task 11572059042454396240 started by @rschumann

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.