fix(06-13): full IANA special-use SSRF tables and reject zoned dial targets

fetchguard/fetch_test.go

@@ -304,3 +304,12 @@ func withTestLoopback(srv *httptest.Server, p Policy) Policy {
 	p.skipReservedCheck = true
 	return p
 }
+
+func TestDialControlRejectsZonedAndSpecialUse(t *testing.T) {
+	ctl := dialControl(Policy{})
+	for _, a := range []string{"[fe80::1%eth0]:443", "198.18.0.1:443"} {
+		if err := ctl("tcp", a, nil); !errors.Is(err, errPrivateIP) {
+			t.Errorf("%s: got %v", a, err)
+		}
+	}
+}