Use server-host as source for public links and warn if it is set to localhost

[anbraten]

closes #247

• Currently the domain (hostname and schema) for public links (mainly webhooks) is gathered from the request url some client accessed the api from
  • It could be dangerous if the server is listening under some unintentional address
  • It could lead to problems where the ui is accessed by some private ip etc
  • It make the setup simpler if DRONE_SERVER is used for all public domains (has to be configured anyways)

resolves #143
resolves #142
resolves #177,

• The additional localhost check helps to identify problems as described by HTTP#500 when trying to activate a Bitbucket Repo in Woodpecker #143 (localhost and private ips can not be used with most most VCS-systems)

[6543]

followup of #175