Disable connector transports without peer pinning

tests/test_storage_backends.py

@@ -18,6 +18,20 @@ def _backend() -> S3StorageBackend:
 
 
 class S3StorageBackendTests(unittest.TestCase):
+    def test_sdk_transport_fails_closed_in_public_and_private_modes(self) -> None:
+        for allow_private, address in ((False, "93.184.216.34"), (True, "10.0.0.5")):
+            with self.subTest(allow_private=allow_private), patch.dict(
+                "os.environ",
+                {
+                    "APP_ENV": "production",
+                    "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": str(allow_private).lower(),
+                },
+            ), patch(
+                "govoplan_core.security.outbound_http.socket.getaddrinfo",
+                return_value=[(2, 1, 6, "", (address, 443))],
+            ), self.assertRaisesRegex(StorageBackendError, "until that transport supports.*DNS/IP pinning"):
+                _backend().client
+
     def test_get_bytes_rejects_declared_oversize_object_without_reading(self) -> None:
         body = MagicMock()
         client = MagicMock()