Validate developer log URL requests

[wagoodman]

The DeveloperLogURL returned by Apple's notarization API was being fetched without any validation, which could allow a malicious or compromised API response to redirect requests to internal services or arbitrary external hosts. This PR fixes this by adding URL validation before fetching notarization logs.

Specific security protections that were added:

• a new domain allowlist (apple.com or from the specific logs s3 bucket)
• a new denylist for any non-host (IP) values
• warn on any unexpected host values (things not on the allow list)
• HTTPS enforcement (HTTP and other schemes not allowed)
• the same rules are applied when there are redirects as well