mirror: re-check the address at sync time #279

Mirror URLs are checked against private, loopback and link-local addresses when saved (internal/control/mirrorcmd.go, via webhook.ValidateURL), but git makes the connection later with no re-check. A hostname that resolves publicly when saved and privately when the mirror runs reaches internal addresses. Webhooks re-check at connect time; mirrors do not.

• Resolve and check the host immediately before each sync and pass git a pinned address, or run mirror git through a proxy that enforces the same rule.