Add optional fetch option to BashOptions (#120)

Allow consumers to inject a custom SecureFetch function instead of
creating one from NetworkConfig. This enables wrapping the fetch layer
with custom logic (e.g., policy evaluation) while keeping built-in
curl unmodified.