[APS-19008] fix IPv6-loopback allowlist entry (::1 -> [::1])

new URL('http://[::1]:x').hostname returns the bracketed form, so the bare '::1'
entry never matched (dead). Use '[::1]' so IPv6 localhost is actually allowed for
local dev, consistent with 'localhost'/'127.0.0.1'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Rohannagariya1

bin/helpers/securityValidation.js

@@ -18,7 +18,8 @@ const path = require('path');
 // production, staging (bsstag.com) and local development. Anything else is
 // treated as attacker-controlled and rejected.
 const ALLOWED_HOST_SUFFIXES = ['.browserstack.com', '.bsstag.com'];
-const ALLOWED_EXACT_HOSTS = ['browserstack.com', 'bsstag.com', 'localhost', '127.0.0.1', '::1'];
+// Note: URL parsing yields '[::1]' (bracketed) as the hostname for IPv6 loopback.
+const ALLOWED_EXACT_HOSTS = ['browserstack.com', 'bsstag.com', 'localhost', '127.0.0.1', '[::1]'];
 
 /**
  * Returns true if the given URL points at a BrowserStack (prod/staging) host or