Function normalize_host 

pub fn normalize_host(host: &str) -> Result<String, NetworkGuardError>

Normalize a DNS host or IP literal for policy matching and SNI selection.

Deliberately stricter than normalize_domain, which exists to be forgiving about how an operator wrote an allowlist entry and will happily parse a whole URL down to its host. A request host is not operator prose: it arrives from a guest or an adapter, so anything carrying a scheme, userinfo, path, or port is a malformed destination rather than something to rewrite. DNS names are ASCII-only; internationalized names must arrive as punycode. IPv6 brackets are accepted and removed, and a single trailing root dot is stripped.

Errors

Returns NetworkGuardError::InvalidHost for a malformed host.