fix: hostname matching allows subdomain bypass via ends_with

## Description The url_match() function uses `host.ends_with(entry.host())` to match hostnames. This allows an attacker to bypass the allowlist: if "example.com" is allowed, then "notexample.com", "evilexample.com", or "notexample.com.evil.com" would ALL match because "notexample.com".ends_with("example.com") is true. This is a critical security flaw in a runtime designed for Lambda/serverless workloads. **Severity**: `high` **File**: `modules/llrt_fetch/src/security.rs` ## Expected Behavior The code should handle this case properly to avoid unexpected errors or degraded quality.