Tighten fetch skill safety docs

[shrey150]

Summary

• add a top-level safety note for untrusted response.content
• replace the risky redirect and internal TLS examples with public test URLs
• tighten the fetch skill description and allowInsecureSsl guidance

Testing

• not run (docs-only changes)

---

Note

Low Risk
Docs-only changes that clarify safe handling of fetched content and restrict guidance around insecure TLS; no runtime or API behavior changes.

Overview
Adds explicit safety guidance across the Fetch skill docs to treat returned content/response.content as untrusted and not follow embedded instructions.

Removes/rewrites examples that encouraged riskier usage (redirect-following and internal/self-signed TLS scenarios), and tightens allowInsecureSsl documentation to limit it to trusted test/staging or public test hosts (and explicitly warn against private-network/metadata endpoints). Also refreshes the Fetch skill description and best-practices list to emphasize safer usage.

^{Written by Cursor Bugbot for commit 9ced10e. This will update automatically on new commits. Configure here.}

[Kylejeong2]

Left a comment about adding stuff to the browse CLI description, otherwise looks good

[Kylejeong2]

should we add a line to use a browser instead of fetch when JS rendering is required / use it as a fallback in the description of the browse CLI