Don't force allowlisted URLs into Google Container

[aaronkollasch]

This PR is to propose a fix for #133.

There are some SSO domains that I also use in a different container – I want the allowlist to allow those domains to be accessed from the Google Container, but not switch containers if the domains are accessed elsewhere. I don't want to use the "don't override containers" option as I find overriding Google domains from other containers still useful.

My current workaround is to add the SSO domains to the allowlist whenever Google requires SSO auth, log in on the Google Container using the SSO domains, then remove them from the list. This is annoying as it occurs ~weekly.

I'm proposing two possible fixes:

1. Simply don't force allowlisted URLs to be opened in the Google Container.
2. Add a separate "soft allowlist" for such URLs. (Though the "soft allowlist" is more in line with my expectations for an allowlist than the current "allowlist", which mandates inclusion).

The two commits on this branch correspond to these two options.