Luke Duncalfe authored Mar 06, 2023 and Stan Hu committed Mar 06, 2023

(Title of this commit has been set to the database migration in order to
generate a correct changelog entry. The feature in these changes is
behind a flag, so the changelog entry is for the database migration
only).

Real title: Add deny all requests setting to UrlBlocker

Adds new ApplicationSetting to deny all requests.

When enabled, this setting will:

- Always allow internal web and shell URIs.
- Always allow object storage URIs.
- Allow URIs that are in the allow list (either host, or IP, local or
  external)
- Deny all other URIs (both local and external).

#377371

Changelog: changed