Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/13

To fix this without changing intended functionality, keep accepting hostnames/IPs for WinRM but strictly validate and normalize target_host before it is ever used in cmd_list.

Best approach in this snippet:

• In core/remote_executor.py, add ipaddress import.
• Replace regex-only check block at lines around 178–184 with:
  • trim input,
  • attempt ipaddress.ip_address(target_host) for literal IPs (canonical normalization),
  • otherwise validate as RFC-like hostname labels (length + label rules, no leading/trailing hyphen, no empty labels),
  • reject anything else.
• Use the resulting normalized host string in cmd_list.

This keeps behavior (host/IP accepted, invalid values rejected) while making validation explicit and much harder to bypass than a broad regex.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.