Add support for host allowlisting to Fetch server

Is your feature request related to a problem? Please describe.
The fetch MCP server currently allows connections to local/internal IP addresses without any restrictions, which poses a security risk. While the README has been updated with a caution notice, this reference implementation could be misused if deployed without proper safeguards.

Describe the solution you'd like
Implement a host allowlisting mechanism for the fetch server that would:

• Allow administrators to specify which hosts/domains the server can connect to
• By default, block connections to local/internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.)
• Provide configuration options to explicitly allow internal IPs if needed for specific use cases
• Implement checks at the socket level to avoid TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities

Describe alternatives you've considered

• Leave as-is with documentation only: Continue with just the warning in the README, but this leaves the reference implementation vulnerable and sets a poor security example

Additional context

• Consider adding example configurations to the Readme showing secure deployment patterns.

Start at the fetch server entry point and review the existing README caution notice to understand current connection handling and configuration. Done means administrators can configure host allowlisting, internal ranges are blocked by default with explicit overrides, socket-level checks address TOCTOU concerns, and the README includes secure deployment examples.