fix(security): prevent SSRF via redirect following in webhook delivery

Webhook fetch calls followed HTTP redirects by default, allowing an
attacker to bypass URL validation by returning a redirect to an
internal endpoint (e.g. cloud metadata service). Setting redirect to
manual prevents the fetch from following redirects automatically.

apps/web/app/api/(internal)/pipeline/route.ts

@@ -94,7 +94,7 @@ export const POST = async (request: Request) => {
   // Fetch with timeout of 5 seconds to prevent hanging
   const fetchWithTimeout = (url: string, options: RequestInit, timeout: number = 5000): Promise<Response> => {
     return Promise.race([
-      fetch(url, options),
+      fetch(url, { ...options, redirect: "manual" }),
       new Promise<never>((_, reject) => setTimeout(() => reject(new Error("Timeout")), timeout)),
     ]);
   };