Warn about remote requests with option to block

Adds a new request filter with three modes:

* Warn on an outgoing remote request (default)
* Stub out remote requests with an empty response
* Allow remote requests without a warning
* Allow adding custom localhost definitions
I think I got confused, because I misinterpreted this comment:

> On further thought I think a simple host match as is sufficient for now.

I inferred that you also thought just dealing with local/remote was fine for now, and that we didn't need a general whitelist/blacklist.

If that's not the case, and you think we should treat this as a general whitelist (instead of a local/remote-specific feature), I think we should make it behave more like the blacklist (use regular expressions, assign an array, etc). I can do that, but I thought this feature would be more straightforward and immediately usable if we only handled the use case we were thinking of.

Think it's worth having a general whitelist?