fix(sandbox): trust exact declared private endpoints

[mjamiv]

Summary

• allow exact user-declared hostname endpoints to resolve to private RFC1918/internal addresses without duplicating allowed_ips
• keep loopback/link-local/unspecified and blocked control-plane ports denied
• preserve policy-advisor two-step SSRF flow for advisor-generated proposals

Fixes #1555.

Testing

• cargo fmt --all -- --check
• git diff --check
• cargo test -p openshell-policy
• cargo test -p openshell-sandbox --lib

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.