fix(hooks): prevent SSRF via URL scheme validation and extend disable mechanism to HTTP hooks

- Restrict HTTP hook URLs to http: and https: schemes only (blocks file://, data://, ftp://)
- Extend hook disable config to cover HTTP hooks by matching against hook URL identifier
- Update all 5 hook executors (pre-tool-use, post-tool-use, stop, pre-compact, user-prompt-submit)
- Add 6 new tests for URL scheme validation (file, data, ftp rejection + http, https, invalid URL)

src/hooks/claude-code-hooks/pre-compact.ts

@@ -52,12 +52,12 @@ export async function executePreCompactHooks(
      for (const hook of matcher.hooks) {
        if (hook.type !== "command" && hook.type !== "http") continue
 
-       if (hook.type === "command" && isHookCommandDisabled("PreCompact", hook.command, extendedConfig ?? null)) {
-        log("PreCompact hook command skipped (disabled by config)", { command: hook.command })
+      const hookName = getHookIdentifier(hook)
+      if (isHookCommandDisabled("PreCompact", hookName, extendedConfig ?? null)) {
+        log("PreCompact hook command skipped (disabled by config)", { command: hookName })
         continue
       }
 
-      const hookName = getHookIdentifier(hook)
       if (!firstHookName) firstHookName = hookName
 
       const result = await dispatchHook(hook, JSON.stringify(stdinData), ctx.cwd)