fix: make_safe_connect crashes on Windows due to missing uvloop

[stayliv3]

Problem

make_safe_connect() in src/bentoml/_internal/utils/uri.py unconditionally imports uvloop (line 69), which is unavailable on Windows. This causes a ModuleNotFoundError crash on any BentoML service that accepts file/image URL inputs, leaving Windows deployments with zero SSRF protection.

Impact

• Affected platforms: Windows (all versions)
• Affected feature: URL-based file input (multipart form with URL string instead of file upload)
• Security impact: Windows users have no SSRF protection — the function meant to block internal network requests crashes before it can do its job
• Symptom: HTTP 500 with ModuleNotFoundError: No module named uvloop in server logs

Fix

Added a try/except ImportError around the uvloop import with a fallback implementation:

• When uvloop is unavailable, patches socket.getaddrinfo to check resolved IPs
• Blocks private, loopback, and link-local addresses (same security policy as the uvloop path)
• Properly restores original getaddrinfo in the finally block
• Respects proxy configuration (same as existing code)

Testing

Before fix (Windows):

Status: 500
Log: ModuleNotFoundError: No module named uvloop

After fix (Windows):

Status: 400
Body: [{"error":"Connection blocked due to insecure input URL"}]

Linux (unchanged):

Status: 400
Body: [{"error":"Connection blocked due to insecure input URL"}]

Verified on:

• Windows 10/11 + Python 3.12 + BentoML 1.4.39
• Linux (Kali) + Python 3.13 + BentoML 1.4.39 + uvloop 0.22.1