Pin the validated IP to the socket to close SSRF DNS rebinding

Validating a hostname then handing it back to an HTTP client re-resolves it, so the checked address is not the connected one. In Python, subclass httpcore._backends.anyio.AnyIOBackend and override connect_tcp to swap the hostname for a pre-approved IP, then assign it to httpx.AsyncHTTPTransport._pool._network_backend. TLS is unaffected: httpcore still passes the hostname as server_hostname, so SNI and cert verification behave normally. Raise from connect_tcp when a host has no pin so the layer fails closed, set trust_env=False so no proxy re-inserts a resolver, and follow redirects manually so every hop is revalidated and re-pinned.