Explicitly empty `url_preview_ip_range_blacklist` still didn't enable URL previews

This issue has been migrated from [#13232](https://github.com/matrix-org/synapse/issues/13232).

---

### Description

I specified this in my config:

```yaml
url_preview_enabled: true
url_preview_ip_range_blacklist: []
```

and URL previews were not enabled. Once I specified a CIDR range under the blacklist, it started up just fine.

For a localhost server I was expecting to be able to URL preview from everywhere, as I understand the risks of clients being able to access "internal" infrastructure.

### Steps to reproduce

see above

### Homeserver

localhost

### Synapse Version

1.62.0

### Installation Method

Docker (matrixdotorg/synapse)

### Platform

Windows host, Docker.

### Relevant log output

```shell
N/A
```

### Anything else that would be useful to know?

it might be reasonable to allow an empty list when the server has a domain name that can't possibly federate (like `localhost`)?

Start by reproducing the reported configuration with URL previews enabled and an explicitly empty url_preview_ip_range_blacklist on Synapse 1.62.0. Trace how this setting is validated and decide the intended security behavior for an empty list, then document the decision with a regression test covering the configuration.

Written by the indexing model from the issue text.