Add inbound hosts to network isolation profile

[eleftherias]

Fix #2023

Add support for configuring inbound hostnames in network isolation profiles.

Network isolation previously blocked container-to-container communication because the ingress proxy only allows traffic from the container's own hostname, localhost, and 127.0.0.1.

Added inbound.allow_host configuration to network permissions profiles.
Example configuration:

  {
    "network": {
      "inbound": {
        "allow_host": ["host.docker.internal", "*.internal"]
      },
      "outbound": {
        "allow_host": ["api.example.com"]
      }
    }
  }

Backward compatibility

For the sake of backward compatibility, if no inbound network permission profile exists, it falls back to the default which allows only the container's own hostname, localhost, and 127.0.0.1.
This is different from the default behaviour of the outbound network permissions.

[codecov]

Codecov Report

❌ Patch coverage is 90.32258% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.16%. Comparing base (90993f6) to head (4e2af1c).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/container/docker/client.go	50.00%	2 Missing ⚠️
pkg/container/docker/squid.go	94.44%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2030      +/-   ##
==========================================
- Coverage   48.17%   48.16%   -0.02%     
==========================================
  Files         233      233              
  Lines       29229    29253      +24     
==========================================
+ Hits        14082    14089       +7     
- Misses      14111    14132      +21     
+ Partials     1036     1032       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

From a quick look this LGTM. Are we thinking of adding e2e tests for this?

[eleftherias]

Are we thinking of adding e2e tests for this?

We don't have any e2e tests for network isolation, happy to add them in a different PR

[JAORMX]

@eleftherias that's why I approved 😄 adding them in a different PR is just fine.