fix(security): treat trailing-dot hosts as their blocked names

validateHost and isLoopbackHost matched hostnames by exact string. The
spellings localhost. and metadata.google.internal. passed the SSRF
check. The check now drops the root dot and any IPv6 zone id first.
A bare IPv6 literal without a port no longer fails the host check.

host_canon_test.go

@@ -0,0 +1,25 @@
+package traefikoidc
+
+import "testing"
+
+func TestValidateHostCanonicalForms(t *testing.T) {
+	o := &TraefikOidc{}
+	blocked := []string{
+		"localhost.", "LOCALHOST.", "metadata.google.internal.", "metadata.google.internal",
+		"169.254.169.254.", "fe80::1%eth0", "[fe80::1]", "::1",
+	}
+	for _, h := range blocked {
+		if err := o.validateHost(h); err == nil {
+			t.Errorf("validateHost(%q) = nil, want blocked", h)
+		}
+	}
+	allowed := []string{"idp.example.com", "idp.example.com.", "2606:4700::1111"}
+	for _, h := range allowed {
+		if err := o.validateHost(h); err != nil {
+			t.Errorf("validateHost(%q) = %v, want allowed", h, err)
+		}
+	}
+	if !isLoopbackHost("localhost.") {
+		t.Error("isLoopbackHost(localhost.) = false")
+	}
+}