Feat: Allowed List of URLs for each `AUTH_API_KEY`

Each `AUTH_API_KEY` will have an `allowed_list` of `URLs` that are allowed to use the key.
The default will be `localhost` and then the `person` that _owns_ the `AUTH_API_KEY` can add more e.g. `app.dwyl.com`
This will mitigate the issue of people using a key they don't own to attempt to authenticate `people` maliciously ...

# Todo

When we re-create the `api_keys` table as part of #207

+ [ ] create the `field: allowed_list, {:array, :string}` to store an array of `String`s

e.g:
```sh
mix phx.gen.schema Blog.Post blog_posts tags:array:string
```

Via: https://stackoverflow.com/questions/33065318/how-to-store-array-with-ecto-using-postgres |> https://hexdocs.pm/ecto/Ecto.Schema.html