add unsafe URL & make config required for Storage classes

[alexcos20]

Closes #106

Changes proposed in this PR:

• add env UNSAFE_URLS, which is an array of regular expressions. If asset URL is a match, access is denied
• add config to Storage constructor

Motivation:
Image a hacker publishing an asset with an URL like "http://169.254.169.254/latest/meta-data/". Then by "downloading" his asset, he will get access to your cloud provider provided metadata, which is a huge security risk

[jamiehewitt15]

This is a good idea but there is no documentation and no default values for unsafe URLs, which makes it hard to use. UNSAFE_URLS also needs to be added to env.md

[jamiehewitt15]

Looks good to me