Allow WebFinger discovery for localhost/private hosts by default

[silverbucket]

Problem

rs.connect("user@localhost:8000") (and any address whose host resolves to a localhost / private IP) fails immediately with WebFingerError: private or internal addresses are not allowed, before any HTTP request is made.

This is a regression introduced by the webfinger.js v3 upgrade in #1370 (commit 490b5f7) and ships in 2.0.0-beta.9. webfinger.js v3 added an allow_private_addresses config option that defaults to false, and WebFinger#resolveAndValidateHost now throws on any host matching its private/localhost regex before attempting the WebFinger lookup.

That breaks:

• Local development against any RS server on localhost.
• Self-hosted users running their RS server on a private LAN address (192.168.x.x, 10.x.x.x, etc.).
• E2E test suites that drive the real OAuth flow against a Dockerized RS server (which is how we hit it — see silverbucket/inbox-rs#105).

Fix

The SSRF protection makes sense for server-side webfinger callers (the original concern in silverbucket/webfinger.js#65), but remoteStorage.js runs in browsers, where cross-origin requests are already gated by the same-origin policy / CORS — the flag's threat model doesn't apply there and only blocks legitimate localhost / LAN development.

This PR takes option 2 from the issue: a new discovery config object, defaulting to true so beta.9's behaviour is restored, with non-browser embedders able to opt back into the SSRF guard.

// Browser apps (default): localhost / LAN discovery works
const remoteStorage = new RemoteStorage();

// Non-browser embedder that wants the SSRF guard back
const remoteStorage = new RemoteStorage({
  discovery: {
    allowPrivateAddresses: false
  }
});

Breaking changes

• discoveryTimeout (a flat top-level constructor option added in beta.9) has
  been replaced by discovery.timeout inside the new discovery config object.
  Update any existing usage:

  // before
  new RemoteStorage({ discoveryTimeout: 10000 });
  
  // after
  new RemoteStorage({ discovery: { timeout: 10000 } });

Closes #1384.

[raucao]

The option key is a bit clunky, because it's so long. Wondering if we should turn that into an object instead and then change the timeout one, too (we can still do breaking changes for 2.0).

[DougReeder]

This is very good!

[DougReeder]

LGTM

[raucao]

Looking great! 👏

The PR description needs to mention the breaking change for the existing discovery timeout config key. At the moment, it only describes the fix.

[silverbucket]

@raucao updated!

[raucao]

@param docs can't be used like that for classes it seems:

I moved the documentation to a a more appropriate place, which fixes the issue and also makes it more prominent/relevant where it's needed: 7129411

I also added a drive-by commit improving some wording on the same page.

[raucao]

👍