Related to T357106

Quick chat with Andrew where we concluded that:

• adjusting the java code to fetch this at runtime was a lot of effort and a high amount of uncertainty about the complexity
• that having github actions regularly run to update the allowlist would work but our previous experience with not merging dependabot PRs suggests we'd still be slow to deploy
• two main options remain:
  • run curl or similar at container start time to download a valid list from the API
  • write to a ConfigMap from the API and pass that into the container
• we would then rely on the the queryservice restarting semi-regularly e.g. due to node updates to trigger the re-reading of the allowlist
• we don't want to schedule this more regularly because we're worried about very regular restarts disrupting users and also the chance of corrupting and then needed to rebuild the internal blazegraph data