fix(hooks): prevent SSRF via URL scheme validation and extend disable mechanism to HTTP hooks

- Restrict HTTP hook URLs to http: and https: schemes only (blocks file://, data://, ftp://)
- Extend hook disable config to cover HTTP hooks by matching against hook URL identifier
- Update all 5 hook executors (pre-tool-use, post-tool-use, stop, pre-compact, user-prompt-submit)
- Add 6 new tests for URL scheme validation (file, data, ftp rejection + http, https, invalid URL)

src/hooks/claude-code-hooks/post-tool-use.ts

@@ -96,12 +96,12 @@ export async function executePostToolUseHooks(
        for (const hook of matcher.hooks) {
          if (hook.type !== "command" && hook.type !== "http") continue
 
-         if (hook.type === "command" && isHookCommandDisabled("PostToolUse", hook.command, extendedConfig ?? null)) {
-          log("PostToolUse hook command skipped (disabled by config)", { command: hook.command, toolName: ctx.toolName })
+        const hookName = getHookIdentifier(hook)
+        if (isHookCommandDisabled("PostToolUse", hookName, extendedConfig ?? null)) {
+          log("PostToolUse hook command skipped (disabled by config)", { command: hookName, toolName: ctx.toolName })
           continue
         }
 
-        const hookName = getHookIdentifier(hook)
         if (!firstHookName) firstHookName = hookName
 
         const result = await dispatchHook(hook, JSON.stringify(stdinData), ctx.cwd)