Support explicit whitelisting of private-network upstreams

[Tilian]

Depends on git-pkgs/registries#51.

Upstream fetches go through registries' dial gate which refuses connections to loopback and link-local addresses.
This currently makes using a deliberately-internal upstream impossible.

This PR exposes registries' new per-host opt-out in config:

upstream:
  maven: "http://maven-mirror.internal.svc.cluster.local:8080/releases"
  allow_private_hosts:
    - "maven-mirror.internal.svc.cluster.local"

or PROXY_UPSTREAM_ALLOW_PRIVATE_HOSTS=host1,host2 (comma-separated).

[andrew]

converting to draft until git-pkgs/registries#51 is merged

[andrew]

git-pkgs/registries#51 merged and released in https://github.com/git-pkgs/registries/releases/tag/v0.7.0

[andrew]

Started rebasing this onto main but hit a structural blocker: Server.Start now builds its own safehttp client (to layer auth and access-log transports) and injects it via fetch.WithHTTPClient, which replaces the fetcher's default transport. fetch.WithAllowPrivateHosts only affects that default transport, so on current main the allowlist would be loaded from config and then never consulted. safehttp.Options only has blanket AllowPrivate, no per-host list.

Opened git-pkgs/registries#67 to add per-host allowlisting to safehttp.Options. Once that's in a tagged release the rebase is straightforward: pass safehttp.Options{AllowPrivateHosts: s.cfg.Upstream.AllowPrivateHosts} at the safehttp.New call and drop the fetch.WithAllowPrivateHosts option. The config, docs, and env-var parts of this PR carry over as-is (env parsing needs restating in the new setEnvString-style LoadFromEnv).

Converting back to draft until the registries change lands.