Fix Codespaces host rejection in Angular SSR host check

[sis0k0]

Problem

Running the client in Codespaces still fails with:

Header "x-forwarded-host" with value "…-4200.app.github.dev" is not allowed.

Root cause

@angular/ssr's isHostAllowed only treats an allowedHosts entry as a wildcard when it starts with *.:

for (const allowedHost of allowedHosts) {
  if (!allowedHost.startsWith('*.')) continue;   // ".app.github.dev" is skipped
  if (hostname.endsWith(allowedHost.slice(1))) return true;
}

The existing entry .app.github.dev (leading dot) is therefore ignored, and the forwarded Codespaces host is rejected. Also, ng serve (what Codespaces runs) validates against the serve target's allowedHosts, not the build target's security.allowedHosts, which had no entry at all.

Fix

• build.security.allowedHosts: .app.github.dev → *.app.github.dev.
• serve.options.allowedHosts: add *.app.github.dev.

Verification

• ng build succeeds; angular.json is valid.
• Reproduced @angular/ssr's matcher: *.app.github.dev allows …-4200.app.github.dev and localhost, and rejects unrelated hosts.