Fix missing outbound_local_requests_allowlist parameter

When we migrated `UrlBlocker` to `HTTP_V2::UrlBlocker`, we missed
passing the `outbound_local_requests_allowlist` parameter to
the `HTTP_V2::UrlBlocker` class from `AddressableUrlValidator`.

In this commit, we are passing the parameter as
`ApplicationSetting.current.outbound_local_requests_whitelist` and
write related tests to cover it.

Bug was introduced in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/141349

Changelog: fixed