Consider expanding `*.spin.internal` in `allowed_outbound_hosts`

[lann]

#3263 mitigates a panic when a service chaining request is made to invalid host with allowed_outbound_hosts = ["*.spin.internal"]. I think it would be more robust to handle this by expanding ["*.spin.internal"] into ["component-1.spin.internal", "component-2.spin.internal", ...] at load time.