Protect against making HTTP requests to private IPs

[LLFourn]

And other addresses where it doesn't make sense. There are a few appraoches:

1. Make using a HTTP proxy mandatory and ask the user to firewall the shit out of it
2. Use a lower level library like hyper to do HTTP requests instead of reqwest and just deny these IPs in software. This might be handy because it gives us fine grained control over the connections establishment including PKI stuff. But it does mean we'd have to re-implement a lot of stuff that reqwest already gets right.
3. Use reqwest but parse the URI first, and manually check whether the host is an IP or a hostname. If it's an IP check it then, otherwise build the reqwest client with a custom DNS resolver which refuses to resolve to private IPs.

I think approach (3) is what I would try first.