mitmweb: protect against dns rebinding

[mhils]

This PR attempts to guard mitmweb against DNS rebinding attacks.

See also:

• mitmweb isn't protected against DNS rebinding #3234
• http://www.tornadoweb.org/en/stable/guide/security.html#dns-rebinding

@atx: My understanding is that enforcing the hostname to match '(localhost|\d+\.\d+\.\d+\.\d+)' should effectively mitigate this while still enabling users to access mitmweb from other hosts if they so desire. Do you see errors in my thinking?

In the long term we should probably adopt a jupyter-style solution, but it's more important to get this fixed quickly now.

[Kriechi]

@mhils: do you want to allow IPv6 addresses too?

[atx]

My understanding is that enforcing the hostname to match '(localhost|\d+.\d+.\d+.\d+)' should effectively mitigate this ...

Yes, that should be sufficient.

[mhils]

Thanks @atx! I added support for IPv6 and included an error message for other hostnames, this is ready for final review.

[Kriechi]

Not sure about the regex - but otherwise fine.