add an option to only ALLOW some ports

[fin444]

This allows you to expose ports from the same container both to the world and to only localhost. For example, you can open Gitlab's SSH port, but keep its :80 private for your reverse proxy. (Yes I know I should be using docker networking instead of localhost it's complicated)