feat(links): scan threats with Google Safe Browsing

[LoneRifle]

Problem

The Virus Scan API for websites provided by Cloudmersive was far
too aggressive, declaring Google Drive links and even a well-known
international organisation as threats. We need a more effective service
that accurately classifies websites that our users link to.

Fixes #377

Solution

Replace Cloudmersive's URL scanning with Google Safe Browsing,
which is more nuanced and more consistent with the browsing experience
for most users, who are probable Chrome users.

• Implement SafeBrowsingService, which vets a given URL against threat
  lists maintained by Google. If we have a match, log the match and
  declare the URL threat

• Drop SafeBrowsingService into inversify, and wire that into
  UrlCheckController

Deploy Notes

New environment variables:

• SAFE_BROWSING_KEY - the Google Cloud API key for Safe Browsing APIs
• REDIS_SAFE_BROWSING_URI - Redis URI for caching Safe Browsing threat matches

[liangyuanruo]

Suggest soft launching so that we don't have to rollback in case of issues. Also, before a full rollout, we're required to implement caching to avoid spamming which could easily happen in the case of a frustrated user.

[yong-jie]

Will we need to modify our warnings to satisfy Google's guidelines? They list 3 things to fulfil

[LoneRifle]

Will we need to modify our warnings to satisfy Google's guidelines? They list 3 things to fulfil

I think we already fulfill the first of the three ("Link is likely to be malicious"). Can I propose that we just tweak the message so that the user gets in touch with us via e-mail if this happens? We would likely be proactive in getting in touch with the user anyway, so we can fulfill the other two parts of the guidelines manually

[liangyuanruo]

lgtm!