@budibase/server: OAuth2 token fetch and REST integration lack SSRF protection

OAuth2 token fetch in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch() without SSRF protection. REST integration in packages/server/src/integrations/rest.ts does not re-check redirect targets against blacklist.

All Budibase deployments where users have BUILDER role; cloud deployments are at risk of metadata exfiltration.

Replace fetch() with fetchWithBlacklist() in OAuth2 token fetch and REST integration, and ensure redirect targets are re-checked.