#1165 Support IP CIDR ranges in NO_PROXY

NO_PROXY entries with a CIDR range were turned into all://192.168.0.0/16, but URLPattern ignored the /16. So NO_PROXY=192.168.0.0/16 bypassed the proxy only for 192.168.0.0 itself, and proxied the other 65,535 addresses. IPv6 ranges like fe80::/10 behaved the same way.

Discussed in #1164.

What changed

• URLPattern matches IPv4 and IPv6 networks, e.g. all://192.168.0.0/16, all://[fe80::]/10. This applies to NO_PROXY and to mounts.
• Bracketed IPv6 networks in NO_PROXY, like [fe80::]/64, are accepted.
• A network is only accepted when written exactly as IP/digits or [IPv6]/digits, like curl and Go do. Anything else, e.g. 10.0.0.0/33, 127.0.0.1/8/../0, 127.0.0.1:8080/8, 10.0.0.0/8? or [fe80::1%eth0]/64, is ignored in NO_PROXY and raises InvalidURL in mounts.
• Mount priority: exact hosts match before networks, smaller networks before larger ones, and networks before catch-all patterns like all://. Host length no longer breaks ties between equal networks, so the scheme does.

Behaviour changes

• Requests to addresses inside a NO_PROXY range now go direct instead of through the proxy.
• mounts keys with an IP host and an invalid network now raise InvalidURL instead of matching only that host.

AI Disclaimer

This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.