hardening(proxy): don't proxy private IP addresses

...by default.

This is useful when RelayDomainNamePattern is lax (e.g. just "$") (which is not the case by default, so this is simply a hardening measure).

• This is based on !377 (closed), expecting that to get merged first.