Provide more proxying control/filtering

[briantist]

For organizations who want to more tightly control which collections are allowed from upstream, it would be great to have blocklist/allowlist support.

Unsure of exactly implementation yet, I could see wanting to limit to whole namespaces, or to full collection names, something in between, etc.

At the moment, orgs who want to do this can achieve it somewhat with a separate process that pulls collections from upstream, and uploads them through galactory (or otherwise uploads them to artifactory with the properties galactory needs); building it into the proxying support should simplify things for those doing it this way.