fix: resolve CI test failures for exotic formats and fetch-urls

Install ImageMagick, Ghostscript, libjxl-tools, and libopenjp2-tools in
CI so exotic format decoder tests (PSD, EPS, HDR, ICO, JP2, etc.) can
run. Relax ImageMagick EPS/PS security policy to match the Dockerfile.

Replace fragile vi.mock() of the SSRF module in fetch-urls tests with an
env-var guard (SSRF_ALLOW_PRIVATE) that bypasses private-IP checks in
the test environment. The vi.mock approach broke under V8 coverage
instrumentation in CI.

vitest.config.ts

@@ -60,6 +60,7 @@ export default defineConfig({
       CONCURRENT_JOBS: "3",
       FILE_MAX_AGE_HOURS: "1",
       CLEANUP_INTERVAL_MINUTES: "60",
+      SSRF_ALLOW_PRIVATE: "1",
     },
     coverage: {
       provider: "v8",