Allow option to restore web_fetch access to private networks

### Describe the feature or problem you'd like to solve

We have placed numerous agentic files (templates and standards) on our corporate network, and now with 1.0.60 the agents are blocked from reading them, causing our agents to start failing.

### Proposed solution

If there's a compelling security-reason to blanket-block all corporate networks, then perhaps at least allow users to white-list specific addresses.

### Example prompts or workflows

Possibly a prompt such as: `/allow-ip <10.1.2.3>`

### Additional context

My company does 62304 medical device development; and to that end we have an internal read-only website hosting useful information:
- A template repository with files consisting of placeholders and agentic prompts to populate. The agents are instructed to use files from the template when making new files (for consistent file formatting)
- A library of standards in versioned directories. The agents are instructed to read the appropriate standards when performing certain types of work

It's on an internal web-site so both humans and agents can read the files and refer to sections; so developing an MCP-server front-end would disrupt the smooth flow and citation references that happen in copilot prompts; and publishing internal company standards on a public website is inappropriate.

Das Issue identifiziert web_fetch als betroffenen Einstiegspunkt, nennt aber keine Dateien oder Tests. Beginne damit nachzuverfolgen, wie web_fetch Anfragen an private Netzwerke blockiert, und überprüfe die bestehenden Sicherheitskontrollen; als abgeschlossen gilt die Arbeit, wenn es eine Opt-in-Möglichkeit gibt, bestimmte private Adressen zu erlauben, während die standardmäßige Einschränkung erhalten bleibt, mit Abdeckung der relevanten Zugriffspfade.

Vom Indexierungsmodell aus dem Issue-Text verfasst.