perf(images): offload validate_url() DNS resolution with asyncio.to_thread (#25825)

validate_url() calls socket.getaddrinfo() for SSRF protection, which
blocks the event loop for 100-700ms per DNS lookup. This affects:

- Image generation (get_image_data) — every external image URL
- Image editing (load_url_image) — every external image URL
- OAuth profile pictures (_process_picture_url) — every login
- Webhook delivery (post_webhook) — every notification
- Image base64 conversion (get_image_base64_from_url) — chat images

Wrap all 5 async call sites in asyncio.to_thread() so DNS resolution
runs in the thread pool. The event loop remains free to serve other
requests during the lookup.

Benchmark (3 domains, 3 trials averaged):
- BEFORE: max jitter 479ms, 1 blocked ping per trial
- AFTER:  max jitter 1ms, 0 blocked pings (324x improvement)

Co-authored-by: Tim Baek <tim@openwebui.com>

backend/open_webui/routers/images.py

@@ -433,7 +433,7 @@ async def get_image_data(data: str, headers=None, trusted_base_url: str | None =
             if trusted_base_url and _is_same_origin(data, trusted_base_url):
                 log.debug(f'Skipping URL validation for trusted backend: {data}')
             else:
-                validate_url(data)
+                await asyncio.to_thread(validate_url, data)
             session = await get_session()
             async with session.get(
                 data,
@@ -862,7 +862,7 @@ async def image_edits(
                 # called only on the originally-submitted URL; following 3xx redirects
                 # without re-validation would let an attacker reach private IPs via a
                 # public host that redirects internally (e.g. cloud-metadata exfil).
-                validate_url(data)
+                await asyncio.to_thread(validate_url, data)
                 # SSRF-safe session: re-checks the connect-time IP so a rebinding DNS answer
                 # that passed validate_url cannot reach an internal address.
                 async with get_ssrf_safe_session() as session: