Implements the generated PluginHttpClient callback interface synchronously via URLSession, with an SSRF guard (scheme allow-list plus resolved-address blocklist) mirroring Android's PluginNetGuard.