fix: address review findings on fetch-url-tool

- fetch_url: revalidate allowlist on every redirect hop (fixes SSRF where
  302 to disallowed host / 169.254.169.254 / file:// bypassed the
  url_allowlist). Stream response body with iter_bytes and cap at 1MB
  so a multi-GB response from an allowlisted host cannot OOM the service.
  Reuses the manual-redirect-loop pattern from yarn_client.

- list_applications: stop swallowing 404 (YARN returns 200+empty for
  "no match"; 404 means the RM doesn't support the endpoint — surface
  the YarnError instead of hiding it as an empty result). Add
  Field(ge=1, le=10000) to ListApplicationsRequest.limit so a runaway
  limit is rejected at the Pydantic layer with 422.

- save_connection: PATCH semantics for existing records. Re-route to
  update_connection when the name already exists so partial updates
  (e.g. only master) no longer wipe url_allowlist back to []. Uses an
  _UNSET sentinel in the tool function to distinguish "omitted" from
  "None" without breaking the existing parameter list.

- README: drop leading space on 5 new connection-tool table rows that
  was breaking GitHub Flavored Markdown table continuity.

- Indentation: normalize connections.py and requests.py to 4-space
  indent (auth_password/auth_principal/auth_keytab were 3-space).

Co-Authored-By: Claude <noreply@anthropic.com>

spark_executor/server.py

@@ -390,12 +390,20 @@ def _list_applications(req: ListApplicationsRequest):
         "yarn_rm_url is required for get_external_* to work** — spark-submit "
         "can discover the RM for submissions, but direct YARN REST queries "
         "need an explicit URL. Saving with an existing name overwrites the "
-        "record in place (no version history)."
+        "record in place (no version history). When the name already exists, "
+        "only the provided fields are changed (PATCH semantics); omitted "
+        "fields keep their previous values."
     ),
 )
 def _save_connection(req: SaveConnectionRequest):
-    # exclude_none so we don't overwrite the function's default with explicit None
-    return save_connection(**req.model_dump(exclude_none=True))
+    fields = req.model_dump(exclude_none=True)
+    name = fields.pop("name")
+    try:
+        get_connection(name)
+    except KeyError:
+        # exclude_none so we don't overwrite the function's default with explicit None
+        return save_connection(name=name, **fields)
+    return update_connection(name=name, **fields)
 
 
 @app.post(