Function host_matches_pattern 

pub fn host_matches_pattern(host: &str, pattern: &str) -> bool

Match a host against an allowlist pattern.

Canonical wildcard syntax is *.example.com (matches api.example.com and example.com). For backward compatibility the legacy leading-dot form .example.com is also accepted and treated identically.

Both layers that perform host-allowlist checks (HostGuard DNS resolver and the B0 safety hook) must call this function so they share a single interpretation of wildcard patterns.