fix(download): require trust for injected sessions

[wunianze666-netizen]

Summary

• prevent a caller-supplied requests.Session from silently bypassing the socket-level SSRF guard while private-address downloads are disabled
• add a default-off requests_session_is_trusted opt-in and reject untrusted injected sessions in the guarded configuration
• preserve the existing explicit allow_private_download_urls=true opt-out
• document the trust boundary, mark test-only injected sessions explicitly, and add regression coverage for both rejection and trusted opt-in

The default production path is unchanged: when no session is injected, the download queue creates its SSRF-guarded session as before.

Related Issues / Discussions

Refs #9493, specifically follow-up item 6.

This PR intentionally does not close #9493 because that issue tracks several independent download-queue security follow-ups.

QA Instructions

Local validation:

• py -m pytest tests/app/services/download/test_download_queue.py -q — 38 passed
• the two new caller-supplied-session security regression tests passed
• Ruff check and format-check passed for the changed Python files
• git diff --check passed

Additional SSRF-suite validation produced 59 passing tests and one unchanged Windows environment failure: urllib.getproxies() reads the machine's system proxy registry. The failure is unrelated to this patch.

Reviewers may want to focus on the compatibility boundary:

1. injected sessions are rejected only when the private-address policy is enabled and the caller has not explicitly trusted the session;
2. sessions created internally continue to use the socket guard;
3. operators who explicitly enable private download URLs retain the existing behavior.

Merge Plan

No special merge steps are required. This is a single backend security commit with focused tests and documentation; it does not change database schemas, Redux state, generated assets, or release metadata.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated (if applicable)
• ❗Changes to a redux slice have a corresponding migration — N/A, no Redux changes
• Documentation added / updated (if applicable)
• Updated What's New copy (if doing a release after this PR) — N/A, this is not a release PR