Add wildcard host matching to AllowedHostsValidator - #701

Support wildcard patterns in the allowlist so trusted host groups can be managed without listing every subdomain explicitly. Keep strict host normalization and validation to preserve safe trust decisions.

Overview

This PR extends AllowedHostsValidator to support wildcard-style host matching via suffix entries (for example, .fabric.microsoft.com) while preserving exact-match behavior.

This is needed for APIs that use dynamic or tenant-specific subdomains, where enumerating every hostname is not practical. With this change, callers can keep host validation enabled instead of falling back to an empty allowed_hosts list.

Related Issue

Fixes #700

Demo

validator = AllowedHostsValidator([".fabric.microsoft.com"])

validator.is_url_host_valid("https://2c662c47.z2c.graphql.fabric.microsoft.com")  # True
validator.is_url_host_valid("https://fabric.microsoft.com")                         # False

Notes

Suffix entries are intentionally subdomain-only:

• .fabric.microsoft.com matches foo.fabric.microsoft.com
• .fabric.microsoft.com does not match fabric.microsoft.com

Exact host entries continue to work as before.

Testing Instructions

• Check out this branch
• From repo root, run:
  • pwsh -File .\kiota-python.ps1 test
• Or run package-scoped tests:
  • Set-Location .\packages\abstractions
  • poetry install
  • poetry run pytest .\tests\authentication\test_allowed_hosts_validator.py
• Verify expected behavior:
  • wildcard/suffix entries match dynamic subdomains
  • bare domain is rejected for suffix entries
  • matching is case-insensitive
  • set_allowed_hosts(...) keeps suffix behavior