Expand list of allowed image hosts

We should make sure assets from local environment (dev/preview/production) are
still allowed.