v21.2.1 — IPv6 loopback parity

A one-line policy fix with an outsized blast radius.

The endpoint validator classified IPv6 loopback (::1) as a reserved address and blocked it, while IPv4 loopback (127.0.0.1) was allowed — so a local model server addressed as http://[::1]:11434 was refused with URL_POLICY: reserved_range even when correctly declared as a local endpoint. Loopback is now governed by the caller's local-endpoint rule for both families, with a parity test pinning it.

Found by the owner connecting a local model on Windows; the same fix pattern (audit the invisible platform assumption, pin it with a test) drives the whole 21.x line.