Don't preview URLs to blocked hosts

What does this PR do?

Reject calls to /url (the URL preview endpoint) if the requested URL points to a blocked host.

Contribution Guidelines By submitting this merge request, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have made sure to test this pull request

packages/backend/src/server/web/UrlPreviewService.ts

@@ -65,7 +65,7 @@ export class UrlPreviewService {
 		reply: FastifyReply,
 	): Promise<object | undefined> {
 		const url = request.query.url;
-		if (typeof url !== 'string') {
+		if (typeof url !== 'string' || !URL.canParse(url)) {
 			reply.code(400);
 			return;
 		}