add a whitelist for repo URI schemes to prevent abuse.

[laurayco]

There's already mitigation in the UI, however this would not stop a nefarious actor who sends a POST request without the UI; this is intended to cover that case.