various: harden input validation; add SSRF protection; fix default API key role

Default API key role was "admin", which was something that I forgot to fix during testing. We
change it to "read-only". 

Additionally repository URLs now reject `file://` scheme (another testing artifact) localhost,
private IP ranges, and cloud metadata endpoints. Nix expressions reject path traversal (`..`)
and absolute paths. Validation is called at the evaluator endtrypoint before command construction.

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I35729c6aa9ec4ff8d1ea19bd57ea93646a6a6964

crates/evaluator/src/nix.rs

@@ -114,6 +114,10 @@ pub async fn evaluate(
   config: &EvaluatorConfig,
   inputs: &[JobsetInput],
 ) -> Result<EvalResult> {
+  // Validate nix expression before constructing any commands
+  fc_common::validate::validate_nix_expression(nix_expression)
+    .map_err(|e| CiError::NixEval(format!("Invalid nix expression: {e}")))?;
+
   if flake_mode {
     evaluate_flake(repo_path, nix_expression, timeout, config, inputs).await
   } else {