Trim trailing dot from trusted IMDS hostnames

[bitterpanda63]

Summary

DNS resolvers sometimes return fully-qualified domain names with a trailing dot (e.g. metadata.google.internal.). The previous direct map lookup in isTrustedHostname did not match this form, so GCP IMDS requests could be incorrectly flagged as stored SSRF.

• Normalize with strings.ToLower + strings.TrimRight(hostname, ".") before the map lookup
• Add "strings" import

This is the same fix already applied in firewall-go (PR #459). Ported to Python, Ruby, .NET, PHP, and Java.

Test plan

• Go tests in lib/request-processor/ pass

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 1	Resolved Issues: 0

🐛 Bugfixes

• Normalized and trimmed trailing dots before trusted hostname comparison
• Stripped trailing dot in NormalizeHostname to handle FQDNs

🔧 Refactors

• Added helpers import and routed hostname checks through helper

^{More info}

[aikido-pr-checks]

Replacing the direct trustedHosts map lookup with helpers.NormalizeHostname(hostname) adds expensive work (URL unescape + IDN conversion) on a likely hot path; consider pre-normalizing or caching hostnames.

Suggested change

	_, exists := trustedHosts[helpers.NormalizeHostname(hostname)]
	_, exists := trustedHosts[hostname]

Details

✨ AI Reasoning
​The code previously did a direct map lookup of the hostname (cheap O(1)). The diff replaces that with helpers.NormalizeHostname(hostname), which runs TrimInvisible, url.QueryUnescape, strings.ToLower, and idna.ToUnicode. These operations allocate and perform non-trivial work (especially IDN conversion). Because isTrustedHostname is likely called per-request for each resolved host, this introduces a performance regression by doing expensive normalization on every check. The added TrimSuffix itself is cheap, but the overall NormalizeHostname call makes the previously trivial lookup much heavier. A lightweight alternative would be to normalize trustedHosts keys up-front or cache normalization results.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}