Origin discovery and migrate refuse a host that resolves to a private address, at every redirect hop

Second third of #2921.

Done looks like:

[ ] src/origins/discover.ts and src/actions/migrate.ts vet every host with vetHost from src/kernel/outbound.ts, not only literal addresses. isPrivateHost stays as the literal check that vetHost uses.
[ ] Discovery follows redirects by hand and vets each hop. A redirect to a private address ends discovery with one sentence.
[ ] The http://127.0.0.1 and localhost exception at discover.ts:143 applies only in dev (the check the rest of the app already uses for dev). Hosts named in FORGE_ORIGIN_ALLOW, if that setting exists, keep working.
[ ] Tests: a migrate from a name that resolves to 10.0.0.5 is refused, discovery that is redirected to 169.254.169.254 is refused, and the loopback exception is off outside dev.

Files: src/origins/discover.ts, src/actions/migrate.ts, test/origins*.test.ts, test/migrate*.test.ts.

Origin discovery and migrate refuse a host that resolves to a private address, at every redirect hop #2993