fix(templates): declare allowedHosts for http-client outbound demo

On wash 2.5.x, a project with no `workload:` block resolves to an
empty ResolvedWorkload and the runtime is fail-closed on empty
`allowedHosts`, so the http-client template's demo flow fails with
HttpRequestDenied out of the box. Declare `httpbin.org` (the default
target) in `workload.allowedHosts` and add a README note pointing
users at the list so they can add their own overrides.

Signed-off-by: Eric Gregory <eric@cosmonic.com>

Author: ericgregory

templates/http-client/.wash/config.yaml

@@ -4,3 +4,10 @@ new:
 build:
   command: npm run build
   component_path: dist/http_client.wasm
+
+# Outbound HTTP is gated by the host runtime. Hosts listed here are
+# allowed for this component; add new hosts before targeting them via
+# the `?url=URL` override.
+workload:
+  allowedHosts:
+    - httpbin.org

templates/http-client/README.md

@@ -48,6 +48,8 @@ npm run dev
 
 All endpoints support the `?url=URL` query parameter to specify a custom target URL.
 
+> **Configuring outbound hosts.** Outbound HTTP is gated by the host runtime; hosts listed in `workload.allowedHosts` in [.wash/config.yaml](.wash/config.yaml) are allowed. The template ships with `httpbin.org` to match the default demo endpoints; add any additional hosts you plan to hit via `?url=URL`.
+
 ## Features
 
 ### 1. Multiple HTTP Methods