Merge Cloud changes back to master - #19827

Automatically merges the latest public Cloud branch changes back into master.

Summary by cubic

Expands the default IP blacklist to block SSRF attempts via IPv6 transition addresses that embed private IPv4 destinations, and fixes blacklist override behavior.

• Decodes embedded IPv4 addresses from IPv4-compatible, 6to4, and NAT64 IPv6 addresses before checking the blacklist.
• Adds 2001::/32 (Teredo) and 64:ff9b:1::/48 ranges to the default blacklist.
• Blacklist overrides now only apply when SELF_HOSTED is set; an empty BLACKLIST_IPS no longer disables defaults elsewhere.

^{Written for commit 6ed1e1d. Summary will update on new commits.}