Developer-friendly method for managing the allow-list

[seanh]

This just needs to be developer-friendly, not support-friendly, so it can be a script or an API, it shouldn't be an admin page. We need to be able to both add things to and remove things from the allow-list:

• Add a site to the allow-list - A pretty rough and ready way of updating the allow list #213
• Non local API based version - API based allow list script #223
• Add instructions for doing this process to Stack overflow - Made a start here: https://stackoverflow.com/c/hypothesis/questions/448/449#449
• Remove a site from the allow-list I'm scratching this off as not required right now. This ticket has gone quite long already

[seanh]

@jon-betts I've edited the description above to clarify that we need to be able to both add sites to and remove sites from the allow-list

[jon-betts]

I've mentioned this in slack, but I'll copy a version of it here too. I don't think we can usefully make a local script for removing things from the list. This is because we are boxed in by a few constraints:

• Modify the list in live (add to it, remove things from it)
• Run this script in dev
• Not have a particular developer be the only person who can run it

Then without a method of syncing the contents of live to our developer machines we can't really search for the right rules to remove. If any of the above changes (we don't want to change it, we run the script on the server, only one person can do it forever), then things change.

It's worth pointing out that technically, this is also true for the add script as well, but the ways in which it fails are far less serious:

• We'll find out if we try and add the same thing twice if we have uniqueness constraints
• There are ways of syncing the block and URLHaus lists locally
• Adding things twice doesn't actually do any harm
• Additions in live we don't have in dev will always be a very small percentage (as we have 125k rules and we're adding single rules manually now)

So right now we are "close enough" because for example both me and Sean at least have a full copy of the live allow list rules locally.

[jon-betts]

I've split off a small bug from this, as the main work is done: #247