Function egress_host_matches 

pub fn egress_host_matches(host: &str, allowed: &[String]) -> bool

Strict egress matching: the deny-by-default sibling of host_matches_allowlist.

allowed is expected to hold entries already canonicalized by normalize_egress_pattern. Matching is:

• exact host equality, or
• *.example.com matching a strict subdomain of example.com.

An apex host never matches through a bare-domain entry’s subdomains, a suffix pattern never matches the apex, and there is no wildcard that matches everything: an entry of * (which validation refuses) would only ever match a literal host named *, so even an unvalidated list fails closed.

An IP-literal host is matched only by an exactly equal entry, never by a suffix pattern. Addresses have no subdomain structure, so treating one as a dotted name would let a pattern like *.0.0.1 match 127.0.0.1 — a real hole, since that pattern passes validation as an ordinary two-label suffix.

An empty allowed list matches nothing: no grant means no reach.