Better validations against internal URLs

[jperichon]

We wanted to extend the coverage of local hosts detection and also allow blacklisting of some domains (eg: internal domains).

[jperichon]

@kritik let me know what you think!

[kritik]

@jperichon I like the idea of blacklisted domains but not of internal IPs. It adds big complexity but I don't see any reason why anyone would use that. Maybe spit commits by two merge requests?

[jperichon]

@kritik Thanks for the quick review, I will split the PR.

I agree on the complexity for detecting internal IPs, but this extended validation can be used to prevent SSRF attacks and make the feature no_local more bulletproof/works as expected.