fix: sanitize host configuration to prevent HTTP header injection

[echobt]

Description

This PR addresses a security vulnerability (HTTP Header Injection / CRLF Injection) where unsanitized user input in the host configuration allowed attackers to inject arbitrary HTTP headers into outgoing requests.

Changes

• Updated Client::new in src/server/client.rs to sanitize the host parameter.
• The sanitization process filters out Carriage Return (\r), Line Feed (\n), and Null (\0) characters from the host string before constructing the base_url.

Verification

• Verified manually with a reproduction test case (locally created and then removed) that injecting CRLF sequences is no longer possible. The sanitized host strips these characters, preventing the injection.
• Existing tests pass.

Related Issue

Fixes #179