Support limiting the allowed base URLs for external data requests

Closes https://github.com/vega/vl-convert/issues/123

In preparation for using VlConvert to replace vega-render-service, this PR adds the allowed_base_urls argument to all of the API's that construct a Vega View in Deno.

Example:

import vl_convert as vlc

vl_spec = {
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "data": {"url": "https://raw.githubusercontent.com/vega/vega-datasets/next/data/movies.json"},
  "mark": "circle",
  "encoding": {
    "x": {
      "bin": {"maxbins": 10},
      "field": "IMDB Rating"
    },
    "y": {
      "bin": {"maxbins": 10},
      "field": "Rotten Tomatoes Rating"
    },
    "size": {"aggregate": "count"}
  }
}

vlc.vegalite_to_png(vl_spec, allowed_base_urls=["https://raw.githubusercontent.com/vega/vega-datasets"])

b'\x89PNG\r\n\x1a\n\x00\x00\x00\...

vlc.vegalite_to_png(vl_spec, allowed_base_urls=["https://bogus"])

---------------------------------------------------------------------------
ValueError                                Traceback (most recent call last)
Cell In[8], line 1
----> 1 vlc.vegalite_to_png(vl_spec, allowed_base_urls=["https://bogus/"])

ValueError: Vega-Lite to PNG conversion failed:
Error: External data url not allowed: https://raw.githubusercontent.com/vega/vega-datasets/next/data/movies.json
    at <anon>:13:15

vega / vl-convert

Support limiting the allowed base URLs for external data requests #124