[feature] Implement explicit domain allows + allowlist federation mode (#2200)

* love like winter! wohoah, wohoah

* domain allow side effects

* tests! logging! unallow!

* document federation modes

* linty linterson

* test

* further adventures in documentation

* finish up domain block documentation (i think)

* change wording a wee little bit

* docs, example

* consolidate shared domainPermission code

* call mode once

* fetch federation mode within domain blocked func

* read domain perm import in streaming manner

* don't use pointer to slice for domain perms

* don't bother copying blocks + allows before deleting

* admonish!

* change wording just a scooch

* update docs

.vscode/settings.json

@@ -3,9 +3,11 @@
 	"go.lintFlags": [
 	  "--fast"
 	],
-	"go.vetFlags": [
-		"-composites=false ."
-	],
+	"gopls": {
+		"analyses": {
+			"composites": false
+		},
+	},
 	"eslint.workingDirectories": ["web/source"],
 	"eslint.lintTask.enable": true,
 	"eslint.lintTask.options": "${workspaceFolder}/web/source"