Function host_matches_allowlist 

pub fn host_matches_allowlist(host: &str, allowed: &[String]) -> bool

True when host matches any entry in a normalized allowed list.

Matching rules, unchanged from the tool-layer original:

• a bare * entry matches everything;
• a *.example.com entry matches example.com and any subdomain;
• an IP entry, or an IP host, matches only exactly;
• a bare domain entry matches itself and any subdomain of it.

These are the permissive semantics the tool-layer allowed_domains lists have always used. A consumer that needs stricter rules — no bare *, no implicit subdomains — must enforce that when it validates its own entries, or use a separate matcher; this function will not reject them.