I've found only this:
In this file
/usr/share/zentyal/stubs/squid/bannedregexpurllist.mas
under "Search engine and related"
there is regexp to block all urls, containing
safe=off
It is close to solution, but I'm searching for urlrewriter (like safesquid), not blocker. And also there is https issue (can't filter ssl url).
I think the only solution is to implement ICAP. but I have no idea how to integrate it with zentyal