fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#671)

v3 port. The Gotenberg PDF driver was missed when the SSRF guards were added
to the AI, exchange-rate and file-disk drivers: gotenberg_host was validated
only with 'url', and the driver POSTs the rendered HTML to it.

Reuses the existing infrastructure (consistency with the other drivers):
- Wires App\Rules\PublicHttpUrl into the gotenberg_host validation rule.
- Adds PrivateNetworkGuard::assertAllowed() in GotenbergPdfDriver before the
  outbound call (covers env/seed/stale config + DNS rebinding).

Adds a unit test asserting the gotenberg_host rule rejects private/loopback/
link-local addresses and allows a public one.

tests/Unit/GotenbergHostValidationTest.php

@@ -0,0 +1,25 @@
+<?php
+
+use App\Http\Requests\PDFConfigurationRequest;
+use Illuminate\Support\Facades\Validator;
+
+test('gotenberg host rejects private, loopback and link-local addresses', function (string $url) {
+    $rules = PDFConfigurationRequest::create('/', 'POST', ['pdf_driver' => 'gotenberg'])->rules();
+
+    $validator = Validator::make(['gotenberg_host' => $url], ['gotenberg_host' => $rules['gotenberg_host']]);
+
+    expect($validator->fails())->toBeTrue();
+})->with([
+    'http://127.0.0.1',
+    'http://169.254.169.254',
+    'http://10.0.0.5',
+    'http://192.168.1.1',
+]);
+
+test('gotenberg host allows a public address', function () {
+    $rules = PDFConfigurationRequest::create('/', 'POST', ['pdf_driver' => 'gotenberg'])->rules();
+
+    $validator = Validator::make(['gotenberg_host' => 'http://8.8.8.8'], ['gotenberg_host' => $rules['gotenberg_host']]);
+
+    expect($validator->errors()->has('gotenberg_host'))->toBeFalse();
+});