Use External URL allow-list service

[streamich]

An ExternalUrl allow list service was added to core.http, it can validate URLs against an explicit allow/deny list in kibana.yml. The service allows all external URLs by default. If externalUrl.policy is configured in kibana.yml then only explicitly allowed URLs will be valid. Here is an example how externalUrl.policy configuration could look:

externalUrl.policy:
  - allow: false
    host: danger.google.com
  - allow: true
    host: google.com
    protocol: https
  - allow: true
    host: elastic.co

Services that could make use of external URL validation.

• Drilldowns. Drilldown allow list #85779 @elastic/kibana-app-services
• Markdown links and images. @elastic/kibana-app-services
• Field formatters. @elastic/kibana-app-services
• Reporting. @elastic/kibana-app-services
• TSVB Respect external URL allow list in TSVB #113094 @elastic/kibana-vis-editors
• Vega Respect external URL allow list in vega #113093 @elastic/kibana-vis-editors
• Graph [Graph] Use ExternalUrl service for checking drilldown URL links #113718 @elastic/kibana-data-discovery
• Canvas? @elastic/kibana-presentation
• Could be a <Link> React component that automatically uses this service. @elastic/kibana-app-services

/cc @legrego

[elasticmachine]

Pinging @elastic/kibana-reporting-services (Team:Reporting Services)

[vadimkibana]

Thank you for contributing to this issue, however, we are closing this issue due to inactivity as part of a backlog grooming effort. If you believe this feature/bug should still be considered, please reopen with a comment.