Find SSRF sinks where the URL is user-shaped

Any HTTP client call whose URL derives from input is SSRF unless the host is validated after DNS resolution.