security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access

Co-Authored-By: Claude <noreply@anthropic.com>

config/permissions/pending_requests.json

@@ -1,18 +1,24 @@
 {
-  "10c4eb6e": {
-    "plugin_name": "example_plugin",
-    "permissions": [],
-    "timestamp": 484215.183089762
-  },
-  "d6f52ecd": {
-    "plugin_name": "example_plugin",
+  "c8a2c46a": {
+    "plugin_name": "sentinel",
     "permissions": [
-      "plugin.example.read",
-      "plugin.example.write",
-      "plugin.example.execute",
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
       "framework.event.subscribe",
       "framework.command.execute"
     ],
-    "timestamp": 484729.685713733
+    "timestamp": 16743.234435695
+  },
+  "87725a61": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 16793.53933677
   }
 }