Hard-code localhost to loopback addresses.

[mikewest]

This patch incorporates draft-ietf-dnsop-let-localhost-be-localhost's recommendation
to hard-code resolution of *.localhost domains to 127.0.0.1 and [::1], matching
the existing behavior of both Chrome and Firefox. This change allows user agents
to ensure that localhost contexts meet the secure context requirements laid out
in https://w3c.github.io/webappsec-secure-contexts/#localhost.

See https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-let-localhost-be-localhost
for additional detail and justification.

• At least two implementers are interested (and none opposed):
  • Chrome ships this mapping.
  • Firefox does as well.
• Tests are written and can be reviewed and commented upon at:
  • I don't think we can test this via WPT, as we can't ensure that a server is running on loopback addresses on the machine from which tests are being executed.
• Implementation bugs are filed:
  • Chrome: https://crbug.com/691930
  • Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1220810
  • Safari: https://bugs.webkit.org/show_bug.cgi?id=171934

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[annevk]

I pushed some nits. In particular I made the IPv6 address go first and used the notation without square brackets as that is reserved for inside URLs.

(This would fix #1118.)

[annevk]

cc @fred-wang

[mikewest]

Your nit fixes LGTM. Thanks!

[ricea]

lgtm