* fix(security): support wildcard/cidr host pattern matching
* fix(security): harden host matching against null and DNS rebinding
* fix(security): handle ipv4 unsigned range and deny template fallback
* test(security): verify CIDR matching for IPv4 upper boundary
* fix(security): set UTF-8 deny response and use Locale.ROOT
* fix(security): enforce whitelist with blacklist and harden wildcard rules