config/security: Add "! " negation to Whitelist, harden default http.urls

Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.

The default security.http.urls now reads:

    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

i.e. allow URLs whose host starts with a letter (the common
"https://example.com" shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/" bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.

    [security.http]
    urls = ['.*', '! ^https?://evil\.example\.com']

Fixes #14792

tpl/openapi/openapi3/openapi3_integration_test.go

@@ -273,7 +273,9 @@ func TestUnmarshalRefRemote(t *testing.T) {
 		})
 
 		dataPartRef := ts.URL + "/api/messages/dataPart.json"
-		return strings.ReplaceAll(refLocalTemplate, "DATAPART_REF", dataPartRef)
+		files := strings.ReplaceAll(refLocalTemplate, "DATAPART_REF", dataPartRef)
+		return strings.Replace(files, "baseURL = 'http://example.com/'",
+			"baseURL = 'http://example.com/'\n[security.http]\nurls = ['.*']", 1)
 	}
 
 	t.Run("Build", func(t *testing.T) {