GHSA-j2hp-6m75-v4j4 imgproxy is vulnerable to SSRF against 0.0.0.0

• Go github.com/imgproxy/imgproxy: < 3.27.2 → fixed in 3.27.2

Summary Imgproxy does not block the `0.0.0.0` address, even with `IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES` set to false. This can expose services on the local host. Details imgproxy protects against SSRF against a loopback address with the following check (source): ``` if !config.AllowLoopbackSourceAddresses && ip.IsLoopback() { return ErrSourceAddressNotAllowed } ``` This check is insufficient to prevent accessing services on the local host, as services may receive traffic on `0.0.0.0`. Go's `IsLoopback` (source) strictly follows the definition of loopback IPs beginning with `127`. `0.0.0.0` is not blocked.