v0.2.1

@particle-academy/prism-browser 0.2.1 — security fix

No breaking changes.

SECURITY: BrowserPolicy promises to refuse a private address even when
the host is allow-listed, but this port's check knew only ::1 for IPv6
and nothing outside the classic IPv4 private ranges. It admitted
100.100.100.200 (Alibaba Cloud's metadata endpoint, in CGNAT), the NAT64
and 6to4 spellings of 169.254.169.254, unique-local and link-local IPv6,
IPv4-mapped loopback, and benchmarking, documentation, multicast, Teredo
and site-local ranges. If you allow-list IP literals, upgrade.

• The check is now the explicit list core's guarded media fetch uses,
  identical in every language.
• NAT64 and 6to4 addresses are judged by the IPv4 address they embed, so
  a DNS64 network's public addresses still navigate.