Extract timetable base-URL validation (private/loopback/metadata/NAT64
block lists + DNS-rebinding address pinning) out of the widget router into a
dedicated timetable-options-validation module, and separate the IPv4 and
IPv6 block lists so each family is matched against its own rules.
Board and options routers load the validator lazily at the call site. Carved
out of #6691 so this security-relevant change can land independently of the
larger widget/integration refactor. All 27 existing SSRF unit tests pass.
Thomas Camlong
e5d15353fe