fix: improve security for SP's XHR proxy default configuration

[pmauduit]

Deny requests via the XHR proxy by default.

Tests:

The XHR proxy is already tested in several ways via the testsuite, see: https://github.com/georchestra/security-proxy/blob/main/src/test/java/org/georchestra/security/PermissionsTest.java

But the new configuration suggested in the PR has been tested with the following test case:

    @Test
    public void testDefaultDatadirConfig() throws IOException {
        Permissions perm = this.load("test-permissions-default-datadir.xml");

        assertTrue(perm.isDenied(new URL("http://www.google.fr/test.html")));
        assertTrue(perm.isDenied(new URL("http://127.0.0.1:8080/console/private/internal/users.json")));
        assertTrue(perm.isDenied(new URL("http://console-svc:8080/console/")));
        assertTrue(perm.isDenied(new URL("https://sdi.georchestra.org/console/")));
        assertTrue(perm.isDenied(new URL("https://demo.georchestra.org/geoserver/wms")));
    }

e.g. with a mix of internal IP addresses, internal host names, and external resources.