[Aikido] AI Fix for Potential user input in HTTP request may allow SSRF attack

[aikido-autofix]

What & why

This patch mitigates the SSRF vulnerability on line 455 by adding URL structure validation using urllib.parse to ensure the JWKS endpoint URL has a valid protocol, hostname, and does not contain path traversal sequences before making the HTTP request.

Fixes #

Scope

• This PR does one thing. Unrelated changes (a security fix + a feature + a refactor) belong
  in separate PRs so each can be reviewed and reverted on its own.

How it was tested

Checklist

• There's a linked issue and the approach was discussed — or this is a small, obvious fix.
• The test suite passes locally, and I added/updated tests for this change.
• It's scoped to the title and doesn't touch unrelated files.
• If I used an AI assistant, I have read, understood and tested every line myself (this is
  not unreviewed generated output), and I've named the assistant/model below — we record it
  for licensing & compliance review.
  
  AI tool / model used: Aikido

---

AI Confidence Level (confidence in the quality of this automated fix): Medium confidence: Aikido has validated similar fixes and observed positive outcomes. Validation is required.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bab9c952-2f5d-4990-a05a-ec1efbdb782c

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[MrMasterbay]

Thanks, not needed: the JWKS URL already goes through sanitize_outbound_url (private ranges blocked unless "Allow private IP" is set) and redirects aren't followed, so this check adds nothing on top. Closing.