[#1532] url_for_static shouldn't work with external URLs. Revert f50a3b.

url_for_static shouldn't allow urls that aren't served in CKAN's static folder,
as this might lead to CSRF vulnerabilities if used with non-escaped user input.
[#1532] url_for_static doesn't accept external URLs and create url_for_static_or_external

The intent of the developer when using url_for_static() is to get the URL for
something that's served in the static folder inside CKAN. It should fail if
called with an external URL. This avoids a possible CSRF vulnerability, if we
allow user-provided input into url_for_static().

For the case when we want to either accept a static object's URL or an external
URL, for example when setting up the g.site_logo, I wrote the
url_for_static_or_external method. This makes it clearer what the user accepts.