Agent Host: Allow option to restore web_fetch access to private networks

Similar to https://github.com/github/copilot-cli/issues/3731 - the new Copilot Agent Host blocks access to private/local IPs. RAG based flows that gather details from internal sites require an ability to re-enable that functionality, or at least the ability to allowlist the necessary DNSs similar to external sites under `chat.tools.urls.autoApprove`.

Sites under `chat.tools.urls.autoApprove` are still blocked.

>GenericFailure, Error: WebFetchBlockedUrlError: web_fetch URL \"https://********\" resolves to blocked address ********. URLs must not target loopback, private, or link-local addresses.