GHSA-c3ch-22rq-xfwr: AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

A previous security fix for CVE-2026-43884 in AVideo was incomplete. The fix patched two files to use a safer URL function, but six or more other parts of the code still don't properly use the `$resolvedIP` parameter (a value returned by the safety check that locks in which server to connect to), leaving the application vulnerable to DNS-rebinding TOCTOU attacks (time-of-check-time-of-use exploits where an attacker changes which IP address a domain points to between when the code checks it and when it actually connects).