Security: Enforce security.ini by default via KCurlWrapper (control hardening)

[Copilot]

Pull Request Checklist

Please complete the following before submitting:

General notes -

• I have tested the changes locally.
• I have written unit tests where applicable.
• I have updated documentation where needed.
• I have added comments to complex code.
• This PR follows the coding style guidelines.
• I have updated release notes with new feature

New Kaltura Types

• I have created new clients
• I have notified related apps - KMCNG / KMS / EP .... about new clients

New Kaltura Services / Actions

• I have added a deployment script

Questions

1. What is the purpose of this PR?

   • Hardens KCurlWrapper::isWhiteListedInternalUrl() to deny internal URLs by default when security.ini is not configured. Previously, missing config meant all internal URLs were allowed (permissive default). Now enforces deny-by-default.

2. Does this change affect production code or infrastructure?

   • Yes
   • No

3. If yes, what is the rollback plan?

   • Revert the single line change in infra/general/KCurlWrapper.class.php (line 725: return false → return true). Alternatively, ensure security.ini is deployed with appropriate internal_url_whitelist patterns before rollout.

---

Change Summary

Before:

if(!kConf::hasMap('security'))
    return true;  // Permissive: allow all internal URLs

After:

if(!kConf::hasMap('security'))
    return false;  // Restrictive: deny all internal URLs

Affects both KCurlWrapper and KAxelWrapper (which extends it). Internal URL access now requires explicit whitelisting in security.ini.