Block private network address feeds

[lemon24]

Needed for hosted reader (i.e. untrusted feeds).

References:

• https://freshrss.github.io/FreshRSS/en/admins/09_AccessControl.html#server-side-feed-fetching--security-considerations
• https://en.wikipedia.org/wiki/Private_network
• https://docs.python.org/3/library/ipaddress.html#ipaddress.IPv4Address.is_private (also is_loopback etc.)

Open questions:

• Default or not? (likely not default, see FreshRSS reasoning)
• Built-in or plugin?
• Hardcoded or allow-list?