Configuration to restrict the hosts and ports accessible by the http proxy servlet

[josegar74]

This change request adds configuration to restrict the hosts and ports accessible by the http proxy servlet, independently of the security mode configured.

• proxy.excludeHosts: Regular expression to match a set of host names / IP's that should not be allowed to access by the http proxy, for example, the ones related to localhost.

• By default, has been changed to only allow the proxy to access ports 80 and 443, additional ports can be configured in proxy.allowPorts

These properties can be configured using multiple methods, not only as init parameter
in web.xml servlet's config, but also as environment variable, system property or config.properties
entry.

[ianwallen]

@josegar74
Would this change also affect/replace the following configuration used ro map services?

core-geonetwork/web/src/main/webResources/WEB-INF/config-spring-geonetwork.xml

Lines 257 to 264 in 6f2819a

	<util:list id="securedMapServices" value-type="org.fao.geonet.domain.mapservices.MapService">
	<!-- Sample secured map services -->
	<!--bean class="org.fao.geonet.domain.mapservices.MapService"
	p:url="http://map1.com" p:useProxy="true" p:authType="BEARER"/-->
	<!--bean class="org.fao.geonet.domain.mapservices.MapService"
	p:url="http:\/\/map1[A-Z].com" p:useProxy="true" p:authType="BASIC" p:urlType="REGEXP" p:username="test" p:password="testpass"/-->
	</util:list>

It would be nice to only have to apply the proxy configuration in one location.

[fxprunayre]

Would this change also affect/replace the following configuration used ro map services?

Not really @ianwallen. It is 2 different things. Here we want to limit proxy access to local resources for security reason. The mapservice config is about accessing remote resources with custom auth.

It would be nice to only have to apply the proxy configuration in one location.

Sure we can work on that in another PR. I propose to merge this one as it is for next release.