PYSEC-2026-4360: Authlib RFC 9101 passes request_uri without validation

In Authlib versions before 1.9.0, RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the get_request_object() hook before applying destination or registration policy. If an integration implements the hook as the unrestricted outbound fetch shown in the documentation, an attacker who knows a valid public client identifier can cause the authorization server to request internal, link-local, or otherwise unintended URLs. The issue is fixed in version 1.9.0.