outbound-hosts restriction is not honored when running this trigger

[rajatjindal]

try changing the url in theasync example without changing the allowed outbound hosts. and observe that it can still make an outgoing request even when that new url is not safelisted in spin.toml

I verified this is not an issue with a regular trigger-http.

[radu-matei]

I can reproduce this as well and when allowed_outbound_hosts is empty or missing.

allowed_outbound_hosts = []