Restrict allowed image hosts

This prevents images not hosted by us from being included in content on GOV.UK
by content editors or an attacker who has gained control of an editor's
account. Such images could be altered to something malicious (or a trollface)
at the whim of the website owner or an attacker who gains control of that
domain.

This is provided by version 19.0.0 of govuk_content_models.

I had to pin various gem versions because otherwise Bundler decided to upgrade
them, with newer versions had been released which weren't compatible with the
app. It may not have been necessary to pin all of them, but it's asking for
trouble to ignore the problem.