Add domain allowlist fields to SandboxNetworkConfig TypedDict (#893)

Brings the Python `SandboxNetworkConfig` TypedDict to parity with the
TypeScript schema. Adds `allowedDomains`, `deniedDomains`,
`allowManagedDomainsOnly`, and `allowMachLookup` so Python SDK users can
configure network allowlists with proper type hints.

Author: an-dustin

src/claude_agent_sdk/types.py

@@ -783,16 +783,24 @@ class SandboxNetworkConfig(TypedDict, total=False):
     """Network configuration for sandbox.
 
     Attributes:
+        allowedDomains: Domain names that sandboxed processes can access.
+        deniedDomains: Domains that are always blocked, even if matched by allowedDomains.
+        allowManagedDomainsOnly: When true in managed settings, only managed-settings allowedDomains are respected.
         allowUnixSockets: Unix socket paths accessible in sandbox (e.g., SSH agents).
         allowAllUnixSockets: Allow all Unix sockets (less secure).
         allowLocalBinding: Allow binding to localhost ports (macOS only).
+        allowMachLookup: macOS only: XPC/Mach service names to allow (supports trailing wildcard).
         httpProxyPort: HTTP proxy port if bringing your own proxy.
         socksProxyPort: SOCKS5 proxy port if bringing your own proxy.
     """
 
+    allowedDomains: list[str]
+    deniedDomains: list[str]
+    allowManagedDomainsOnly: bool
     allowUnixSockets: list[str]
     allowAllUnixSockets: bool
     allowLocalBinding: bool
+    allowMachLookup: list[str]
     httpProxyPort: int
     socksProxyPort: int