Whether url is safe to fetch or open — see safeBrandUrlOrNull, which callers should prefer for the value.