Restrict Access to Approved Git Domains

**Is your feature request related to a problem? Please describe.**
Currently, the proxy accepts repositories from any arbitrary URL on the internet. This broad acceptance expands the attack surface and introduces security risks, as malicious or unexpected domains could masquerade as legitimate Git hosts.

**Describe the solution you'd like**
Add an explicit allowlist of repository hosts. The proxy should reject any repository URL whose host isn’t in the allowlist. This would:

- **Default‑deny** unknown hosts, reducing exposure to untrusted sources.
- **Be config‑driven**, simple to maintain, and secure (GitHub can be the default).
- **Support mapping known hosts to providers**

**Describe alternatives you've considered**
Leaving the proxy open to all URLs is simpler initially but risky long‑term. Another option would be to attempt to validate host domains dynamically, but this is harder to secure and maintain than a clear allowlist.

**Additional context**
An allowlist simplifies configuration, improves security, and ensures only approved domains can be proxied. This also helps avoid accidental exposure to untrusted or typo‑squatted domains.