Connect remote fetches only to public addresses and require page write to convert images

Blocks remote fetches to internal addresses, including public URLs that redirect to one, and requires page write permission to convert images.