fix: SECURITY: Unquoted curl URLs with variables in API calls (#60)

Add URL validation helper to prevent URL injection attacks in API calls.

- Added validate_url() helper in lib/env.sh to validate URL format
- Added validation to forge_api() to prevent URL injection
- Added validation to woodpecker_api() to prevent URL injection
- Added validation to ci-debug.sh api() function
- All URLs are already properly quoted with "${VAR}/..." patterns
- This adds defense-in-depth by validating URL variables before use

lib/ci-debug.sh

@@ -17,6 +17,11 @@ REPO="${FORGE_REPO}"
 API="${WOODPECKER_SERVER}/api/repos/${WOODPECKER_REPO_ID}"
 
 api() {
+  # Validate API URL to prevent URL injection
+  if ! validate_url "$API"; then
+    echo "ERROR: API URL validation failed - possible URL injection attempt" >&2
+    return 1
+  fi
   curl -sf -H "Authorization: Bearer ${WOODPECKER_TOKEN}" "${API}/$1"
 }