Reject images that are not on the assets domain or a relative path

(Paired with @jamiecobbett on this.)
This may make the whole thing moot anyway: https://github.com/alphagov/govspeak/pull/37