fix(sub): treat external subscription providers as untrusted input

A client's external subscription is fetched from a third party on every
subscriber refresh, and the fetcher trusted it more than its siblings:
- it dialled any address, redirects included; it now goes through the
  SSRF guard like the outbound subscription and remote routing fetchers;
- it forwarded any line containing "://"; it now keeps only server share
  links, so app deeplinks and plain URLs never reach the subscriber's app;
- it bounded the body but not the link count (now 1000) or the headers
  (now 64 KiB), and stored the raw error, URL included, on every row; the
  stored error is now host-only and at most 1 KiB.

The link parser also refuses links that nest JSON past 16 levels, since
the JSON subscription pretty-prints it at quadratic cost, and external
configs are marshalled compactly until the final, single indent pass.

internal/sub/external_config.go

@@ -203,7 +203,8 @@ func parsedExternalOutbound(rawLink string) json_util.RawMessage {
 		return nil
 	}
 	ob["tag"] = "proxy"
-	b, err := json.MarshalIndent(ob, "", "  ")
+	// Compact: the response is indented once at the end, and each extra pass costs per level.
+	b, err := json.Marshal(ob)
 	if err != nil {
 		return nil
 	}