SSRF (as mentioned in FinalDestination::SSRFDetector) stands for Server-Side Request Forgery. It refers to a mechanism by which an attacker tricks your server into accessing resources that the attacker would otherwise not be able to access.
For example, imagine you were running Discourse inside a private network with a reverse proxy to allow access from the internet. An attacker could create a topic with a link pointing at an IP address inside your private network. Discourse’s Onebox system might then retrieve that URL and display its contents in a Onebox.
To prevent that, Discourse doesn’t access any user-provided URLs without first checking that they don’t point to private IP addresses.
Arguably this might be less important for git repositories used by themes and theme components, since those are specified by admins, but Discourse is erring on the side of caution here.