fix(security): treat trailing-dot hosts as their blocked names

validateHost and isLoopbackHost matched hostnames by exact string. The
spellings localhost. and metadata.google.internal. passed the SSRF
check. The check now drops the root dot and any IPv6 zone id first.
A bare IPv6 literal without a port no longer fails the host check.

settings.go

@@ -954,6 +954,7 @@ func isValidSecureURL(s string) bool {
 // isLoopbackHost reports whether host is "localhost" or a loopback IP literal
 // (127.0.0.0/8 or ::1).
 func isLoopbackHost(host string) bool {
+	host = canonicalHost(host)
 	if strings.EqualFold(host, "localhost") {
 		return true
 	}