Security Advisory: Keep HTTP API local and reject caller-supplied proxy

Security Improvement

A security improvement has been submitted via PR #482: https://github.com/JoeanAmier/XHS-Downloader/pull/482

Summary: Keep HTTP API local and reject caller-supplied proxy

This PR was generated by an automated security scan and has passed focused tests. Please review the PR for details and merge at your discretion.

---

Submitted by: @failsafesecurity (FailSafe Security Research)