[feature] Implement explicit domain allows + allowlist federation mode (#2200)

* love like winter! wohoah, wohoah

* domain allow side effects

* tests! logging! unallow!

* document federation modes

* linty linterson

* test

* further adventures in documentation

* finish up domain block documentation (i think)

* change wording a wee little bit

* docs, example

* consolidate shared domainPermission code

* call mode once

* fetch federation mode within domain blocked func

* read domain perm import in streaming manner

* don't use pointer to slice for domain perms

* don't bother copying blocks + allows before deleting

* admonish!

* change wording just a scooch

* update docs

internal/config/validate.go

@@ -61,6 +61,17 @@ func Validate() error {
 		errs = append(errs, fmt.Errorf("%s must be set to either http or https, provided value was %s", ProtocolFlag(), proto))
 	}
 
+	// federation mode
+	switch federationMode := GetInstanceFederationMode(); federationMode {
+	case InstanceFederationModeBlocklist, InstanceFederationModeAllowlist:
+		// no problem
+		break
+	case "":
+		errs = append(errs, fmt.Errorf("%s must be set", InstanceFederationModeFlag()))
+	default:
+		errs = append(errs, fmt.Errorf("%s must be set to either blocklist or allowlist, provided value was %s", InstanceFederationModeFlag(), federationMode))
+	}
+
 	webAssetsBaseDir := GetWebAssetBaseDir()
 	if webAssetsBaseDir == "" {
 		errs = append(errs, fmt.Errorf("%s must be set", WebAssetBaseDirFlag()))