CVE-2026-34954: PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL

FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services.