signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...