fix: validate webhook URL scheme to prevent SSRF via urllib

orders.py

@@ -280,6 +280,11 @@ class OrdersHandler(BaseHTTPRequestHandler):
             try:
                 import urllib.request
                 import json
+                import urllib.parse
+                parsed = urllib.parse.urlparse(webhook_url)
+                if parsed.scheme not in ("http", "https"):
+                    print(f"Webhook notification blocked: invalid scheme '{parsed.scheme}'")
+                    return
                 data = json.dumps({"email": email, "note_id": note_id}).encode()
                 req = urllib.request.Request(webhook_url, data=data, headers={"Content-Type": "application/json"})
                 urllib.request.urlopen(req, timeout=10)