Fix allowlist to honor IP addresses and CIDR ranges

[ACK-J]

Summary

Fixes #66 and #64 by making IP address and CIDR allowlist entries actually take effect.

Also fixes a follow-up issue where whitelisting 127.0.0.1 did not stop TestPortScans.html from being blocked.

Problem

• [Feature Request] Expand "domain" whitelist to be able to include IP addresses #66: IP allowlist entries were ignored because origin hosts include ports (e.g. 127.0.0.1:8080) while entries were stored without them.
• [Feature Request] Whitelist supports CIDR #64: Homelab users (e.g. Proxmox) need CIDR support for private subnets.
• TestPortScans regression: The allowlist only checked the page origin, not the scan target. Opening TestPortScans.html from file:// or localhost scans 127.0.0.1 as a third-party request, so whitelisting 127.0.0.1 had no effect on the destination.

Solution

• IP entries without a port match the same address on any port
• CIDR ranges match IPv4 and IPv6 origins/destinations
• localhost is treated as equivalent to 127.0.0.1
• Domain entries still only match the page origin (e.g. discord.com)
• IP and CIDR entries match both the page origin and local/private request destinations

Example

Page origin	Scan target	Allowlist	Result
file:// (empty host)	127.0.0.1:80	127.0.0.1	Allowed
localhost	127.0.0.1:80	127.0.0.1	Allowed
evil.com	127.0.0.1:80	127.0.0.1	Allowed
evil.com	10.0.0.1:80	127.0.0.1	Blocked
evil.com	127.0.0.1:80	discord.com	Blocked
discord.com	127.0.0.1:80	discord.com	Allowed

Test plan

• Verified matching logic for origins, destinations, localhost, CIDR, and domains
• Add 127.0.0.1 to allowlist, open TestPortScans.html from disk, confirm 127.0.0.1 scans are not blocked
• Add LAN CIDR (e.g. 192.168.1.0/24) and confirm Proxmox shell/console connections work
• Confirm discord.com allowlist still only applies to pages on discord.com, not all scans to local IPs