Check the address a supervisor hands back before calling it (#51)

`resolveBaseUrl` returns a URL and the next line puts it into `fetch` with this
deployment's computer token on it. That was fine while the only supervisor was
ours, answering on loopback. It stops being fine with a hosted provider, where
the address arrives from a third party's API and we call whatever it says.

Deliberately not the navigation check. That one refuses private hosts, which is
correct for a Bot browsing and exactly wrong here: our own supervisor answers
`http://127.0.0.1:<port>` for a container on this machine, so reusing it would
refuse the ordinary case.

What survives is what holds however the address was produced. The scheme has to
be one a computer speaks, and the cloud metadata addresses are refused whatever
anything says, because that is how a container's credentials leave it and no
supervisor has a reason to name one.

Groundwork for A10, where the supervisor becomes somebody else's API.