Fix parsing of allowed_outbound_hosts entries containing IPv6 literals or IPv6 CIDR ranges without an explicit port.

Previously, rsplit_once(':') could mistake an IPv6 address segment for a port. These entries now use the scheme’s default port:

• http://[::1]
• https://[::1]
• http://ff00::/8

The updated parsing also:

• Validates and normalizes wildcard domain suffixes.
• Rejects malformed paths and multiple trailing slashes while allowing one empty trailing slash.
• Keeps RFC 3986-compatible empty ports, such as http://example.com:/, accepted.

Added regression coverage for IPv6 parsing and matching, malformed authorities, wildcard domains, paths, and error messages.