Function is_allowed_origin 

pub fn is_allowed_origin(origin: &str) -> bool

Returns true if origin (from the HTTP Origin header) is a localhost origin, a tauri:// origin, or absent.

Uses url::Url::parse internally so that subdomain-smuggling attacks like localhost.evil.com are caught by comparing the parsed host rather than doing prefix matching.