#41749 fix: downloadPublicImportFile doesn't use serverFetch with domain/IP validation checks

Proposed changes (including videos or screenshots)

Replaces the native http implementation with serverFetch in downloadPublicImportfile since it adds SSRF checks/protection.

Issue(s)

https://rocketchat.atlassian.net/browse/VLN-564

Steps to test or reproduce

In the Jira issue.

Further comments

Summary by CodeRabbit

• Security

  • Improved protection against server-side request forgery when downloading public import files.
  • Downloads now respect configured URL allowlists and reject unauthorized private URLs.

• Bug Fixes

  • Failed downloads are correctly marked as failed and cleaned up.
  • Download errors and unsuccessful responses are handled more reliably.
  • Allowlisted downloads continue to complete successfully with accurate completion tracking.
  • Import progress and completion status now remain accurate when response or file-writing streams fail.