Harden the remote worker: TLS off loopback, full digests, filtered env

fluksio-worker now refuses ws:// and http:// engine and artifact URLs unless
they are loopback or --insecure is given; the engine still accepts both.
An artifact reference must be sha256: plus 64 hex digits before it is joined
into a path, and node code gets the host environment through the engine's
credential denylist instead of all of it.

docs/code/workers.md

@@ -39,6 +39,15 @@ driver in order to run a training step. An engine host already has it, and
 | `--gpus` | what the job says, else counted | GPUs to advertise |
 | `--ram-mb` | what the job or the machine has | memory to advertise, in MB |
 | `--max-idle` | never | stop after this many seconds with nothing running |
+| `--insecure` | off | allow `ws://` and `http://` to an engine on another machine |
+
+The worker refuses a plain `ws://` or `http://` address unless the engine is on
+this machine (`localhost`, `127.0.0.0/8`, `::1`): its token and every secret a
+node is handed would cross the network in clear. `--insecure` is for a network
+you trust, such as an engine on the same LAN without TLS. Node code gets this
+host's environment less anything named like a credential (`*TOKEN*`,
+`*SECRET*`, `*PASSWORD*`), the same as on the engine; hand a node a credential
+as a [secret](../interface/operations.md#secrets) instead.
 
 `--python` is the important one. It is how this machine keeps its own wheels
 (the CUDA build, the vendor SDK, the thing that will not install anywhere else)