fix: block full 172 private host range

[silentgeckoaudit3801]

Closes #1339

Summary:

• Expand the private-host guard to cover the full RFC1918 172.16.0.0/12 range, including 172.16.x.x.
• Export the helper so the boundary logic can be tested directly.
• Add regression coverage for 172.16/172.31 being blocked and neighboring public 172.15/172.32 ranges remaining allowed.

Validation:

• Static GitHub API/source inspection only; local backend dependency or test commands were not run to avoid installing or executing project dependencies in this environment.