`allowInsecure: false` should respect Secure Contexts

[lidel]

Problem

Setting allowInsecure: false should not be blindly blocking http://, it should not block requests to http://localhost and http://*.localhost because these are valid Secure Contexts.

This bug blocks users from using their own local gateway (ipfs desktop, kubo, rainbow).

Solution

Correctly recognize http://localhost[:port] and http://*.localhost[:port] as secure contexts.

[!IMPORTANT] Only localhost label is marked as Secure Context, URLs with loopback 127.0.0.1 IPs are not.

Ref.

• https://github.com/ipfs/helia/blob/74ccc92793a6d0bb4bee714d9fe4fa4183aa4ee8/packages/block-brokers/src/trustless-gateway/utils.ts#L12
• TLDR: https://github.com/ipfs/in-web-browsers/issues/109#issuecomment-1344368343
• W3C: https://w3c.github.io/webappsec-secure-contexts/#localhost
• IETF: https://datatracker.ietf.org/doc/html/draft-west-let-localhost-be-localhost