Adds ALLOWED_IMPORT_PATHS for file:// urls

[bmbouter]

Remote.url now validate to only allow file:// paths that are a subpath
of a configured ALLOWED_IMPORT_PATHS setting. This setting comes with
docs. URLs starting with other protocol handlers, e.g. http:// or
https:// are unaffected.

https://pulp.plan.io/issues/5974
closes #5974

[bmbouter]

@gmbnomis What do you think of this PR?

Note also I wanted to have the validation occur at sync time, but what I realized is that sync code is fully in the control of the plugin so every plugin would need to add it. Is preventing any file:// from saving enough? What do you recommend?

[daviddavis]

I feel like we should probably call out in the docs that ALLOWED_IMPORT_PATH is only checked at Remote creation/update and not before sync. Users might mistakenly think they can edit it on the fly.

[bmbouter]

I added a note to the docs about it only be checked at creation or update time.

[bmbouter]

Actually I realized we could put an additional check in the FileDownloader here and then I could remove this note and make it better. Wdyt?

[bmbouter]

This is not great, but I tried to work around the circular import several ways and it was still there.

[daviddavis]

maybe leave a comment?

[bmbouter]

Anytime I see these I think circular import. I will if you want tho just lmk.