fix: block loopback addresses by default in NetworkPolicy

[danbugs]

Summary

• Blocks 127.0.0.0/8 and ::1 in NetworkPolicy::check() for all policy variants, using addr.ip().is_loopback()
• Host-local services typically trust loopback traffic and perform no authentication — a guest with AllowAll/BlockList policy could previously reach databases, Docker API, admin panels, etc. on the host
• Adds net_loopback_blocked test covering both IPv4/IPv6 under AllowAll and BlockList policies

Test plan

• cargo test --lib passes (54 tests)
• cargo clippy clean
• cargo fmt clean

[Copilot]

Pull request overview

Adds a defense-in-depth block of loopback addresses (127.0.0.0/8 and ::1) in NetworkPolicy::check(), mirroring the existing link-local block, so guests cannot reach host-local services regardless of policy variant.

Changes:

• In NetworkPolicy::check(), reject any destination whose IP is a loopback address before evaluating the policy variant.
• Add net_loopback_blocked test covering IPv4/IPv6 loopback under both AllowAll and BlockList policies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Linux Benchmarks

Details

Benchmark suite	Current: db5dc93	Previous: 2c92788	Ratio
hello_world (median)	20 ms	20 ms	1
pandas (median)	100 ms	110 ms	0.91
density (per VM)	7 MB	7 MB	1
snapshot (disk)	385 MiB	385 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Windows Benchmarks

Details

Benchmark suite	Current: db5dc93	Previous: 2c92788	Ratio
hello_world (median)	248 ms	187 ms	1.33
pandas (median)	782 ms	545 ms	1.43
density (per VM)	6 MB	6 MB	1
snapshot (disk)	392 MiB	392 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.