Security Hardening & Reliability Fixes

Security Fixes

Blocks server-side request forgery (SSRF) vulnerabilities in the logo conversion pipeline by restricting outbound requests to public addresses only, enforcing a 10-hop redirect limit, and requiring HTTPS for project logo URLs.
Fixes a privacy issue where a project contributor's email address could be inadvertently exposed to unauthenticated users through audit attribution records. Email fields are now omitted from viewer-level attribution on project links, folders, and documents.
Adds a 10 MiB size cap on downloaded logo files to prevent resource exhaustion from oversized or maliciously crafted image payloads.

Fixes a race condition in project creation where two concurrent requests for the same slug could both succeed. Slug reservation is now performed atomically, ensuring uniqueness.
Reduces unnecessary processing by skipping authorization sync messages when a project base update contains no access-relevant changes.