Add an allowed_image_hosts option

This lets us specify that images not hosted on GOV.UK (ie relative paths) or on
the GOV.UK asset domain are not sanitary - these images could be changed at the
whim of that website owner, potentially to something malicious.

Currently, we've implemented this in addition to using the Govspeak::HtmlValidator. This means converting every string field in an API request to HTML twice. See: https://github.com/alphagov/hmrc-manuals-api/commit/34b8478a97292c6bed76372f71d3f76ba957509d
Rather than passing this to the `valid?` method, would it be better to pass it to `initialize`?