Don't preview URLs to blocked hosts

What does this PR do?

Reject calls to /url (the URL preview endpoint) if the requested URL points to a blocked host.

Contribution Guidelines By submitting this merge request, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have made sure to test this pull request