Block local URLs for external controls on SaaS

- Local addresses are fine for other contexts since users might
  have services running on the same host they need to access.

- Evaluation of .com? state moved to instance evaluation since
  otherwise the specs are not going to pick up the mocked change
  given that validations are load time evaluated.

- Refs: https://gitlab.com/gitlab-org/gitlab/-/issues/515773

Changelog: changed
EE: true