Add an allowed_image_hosts option

This lets us specify that images not hosted on GOV.UK (ie relative paths) or on
the GOV.UK asset domain are not sanitary - these images could be changed at the
whim of that website owner, potentially to something malicious.