feat: require an allowlist for remote URL images

[psxjoy]

Purpose of the pull request

Make remote URL image fetching explicit and fail closed. This PR requires callers to configure exact trusted hosts before UrlImageConverter performs any outbound request.

What's changed?

• Add an exact-host allowedHosts(...) policy and disable remote URL image fetching when the allowlist is empty.
• Normalize domain names, internal hostnames, IDNs, trailing dots, and IPv6 literals consistently.
• Reject wildcards, URL components, user info, whitespace, and invalid host entries.
• Validate the allowlist before DNS resolution and revalidate every redirect target.
• Keep private-host and private-CIDR authorization as an additional security boundary.
• Match hosts independently of URL ports.
• Update the English and Chinese URL image documentation.
• Add focused tests for default-deny behavior, exact-host matching, redirects, private-network authorization, and invalid configurations.

The default-deny behavior is an intentional security hardening. Applications that use remote URL images must explicitly configure their trusted hosts.

Verification

• ./mvnw -pl fesod-sheet -Dmaven.test.skip=false -Dtest=UrlImageFetchPolicyTest,UrlImageConverterTest spotless:check test
• 16 focused tests passed.
• English and Chinese documentation passed Markdownlint.

Checklist

• I have read the Contributor Guide.
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed.

[psxjoy]

Please do not merge this PR until the official release begins.