Port 14 upstream agent security / correctness fixes to Go canvas (#16455)

Mirrors 14 merged upstream PRs into the Go agent port.

PRs ported:
  - #15609 ExeSQL SSRF guard + DNS pin
  - #15436 HTTP timeout on external API tools
  - #16363 be_output restore + DeepL error path
  - #15644 switch no longer matches empty condition
  - #15374 session_id bind to path agent_id (DAO idor guard)
  - #16169 sandbox artifact ownership gate
  - #15457 tenant ownership on agentbots
  - #15145 rerun agent document access check
- #15446 thinking switch (component portion; provider policy lives in
internal/llm)
  - #15426 Invoke URL/proxy SSRF + DNS pin + no-redirects
  - #15238 agentbot thinking-logs beta endpoint
  - #14589 UserFillUp SSE event propagation
  - #14890 anonymous webhook opt-in
- #15068 PipelineChunker new component (text/file_ref/parser_id
dispatch; file-format extraction is a follow-up)

40 files, +2355 / -58 lines. 33 new tests, all targeted package suites
pass (1721 + 4 skipped); 1 pre-existing flaky test unrelated.

docker/.env

@@ -1,6 +1,6 @@
 # -----------------------------------------------------------------------------
 # SECURITY WARNING: DO NOT DEPLOY WITH DEFAULT PASSWORDS
-# For non-local deployments, please change all passwords (ELASTIC_PASSWORD, 
+# For non-local deployments, please change all passwords (ELASTIC_PASSWORD,
 # MYSQL_PASSWORD, MINIO_PASSWORD, etc.) to strong, unique values.
 # You can generate a random string using: openssl rand -hex 32
 # -----------------------------------------------------------------------------
@@ -239,7 +239,7 @@ EMBEDDING_BATCH_SIZE=${EMBEDDING_BATCH_SIZE:-16}
 # ENDPOINT=http://oss-cn-hangzhou.aliyuncs.com
 # REGION=cn-hangzhou
 # BUCKET=ragflow65536
-# 
+#
 
 # A user registration switch:
 # - Enable registration: 1