Trim trailing dot and normalize case for trusted IMDS hostnames

DNS resolvers may return hostnames with a trailing dot (FQDN form),
e.g. `metadata.google.internal.`. The previous equality check failed
to match these, risking false-positive stored-SSRF blocks for GCP IMDS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/imds/TrustedHosts.java

@@ -13,6 +13,10 @@ private TrustedHosts() {}
 
     /** Checks if this hostname is trusted */
     public static boolean isTrustedHostname(String hostname) {
-        return Arrays.asList(trustedHosts).contains(hostname);
+        String normalized = hostname.toLowerCase();
+        if (normalized.endsWith(".")) {
+            normalized = normalized.substring(0, normalized.length() - 1);
+        }
+        return Arrays.asList(trustedHosts).contains(normalized);
     }
 }

agent_api/src/test/java/vulnerabilities/ssrf/ResolverTest.java

@@ -85,4 +85,13 @@ void testResolvesToImdsIp_WithMultipleResolvedIps_OnlyTrustedHostname() {
 
         assertNull(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal"));
     }
+
+    @Test
+    void testResolvesToImdsIp_TrustedHostnameWithTrailingDot() {
+        Set<String> resolvedIps = new HashSet<>();
+        resolvedIps.add("169.254.169.254"); // IMDS IP
+
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal."));
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "metadata.goog."));
+    }
 }