Adds support for proper localhost loopback on RFC 6761 (microsoft#256617)

* fix: enhance localhost authority checks

- 🔍 Added TLD matching for localhost variations
- ✅ Updated tests to cover new localhost cases

* Merged tld back into overal rLocalhost regex

Author: timheuer

src/vs/workbench/contrib/url/common/trustedDomains.ts

@@ -50,7 +50,7 @@ export function normalizeURL(url: string | URI): string {
 		}
 	} catch { return url.toString(); }
 }
-const rLocalhost = /^localhost(:\d+)?$/i;
+const rLocalhost = /^(.+\.)?localhost(:\d+)?$/i;
 const r127 = /^127.0.0.1(:\d+)?$/;
 
 export function isLocalhostAuthority(authority: string) {

src/vs/workbench/contrib/url/test/browser/trustedDomains.test.ts

@@ -37,6 +37,11 @@ suite('Link protection domain matching', () => {
 		linkAllowedByRules('https://127.0.0.1:3000', []);
 		linkAllowedByRules('https://localhost', []);
 		linkAllowedByRules('https://localhost:3000', []);
+		linkAllowedByRules('https://dev.localhost', []);
+		linkAllowedByRules('https://dev.localhost:3000', []);
+		linkAllowedByRules('https://app.localhost', []);
+		linkAllowedByRules('https://api.localhost:8080', []);
+		linkAllowedByRules('https://myapp.dev.localhost:8080', []);
 	});
 
 	test('* star', () => {