fix(jsonrpc-utils): require exact loopback host for isLocalhostUrl

[SashaMIT]

Summary

isLocalhostUrl used an unanchored wss?://localhost regex. That matched wss://localhost.evil.example / wss://localhostfoo, and ws-connection then set rejectUnauthorized: false.

Parse with URL and allow only exact websocket hosts localhost, 127.0.0.1, and ::1 / [::1].

Test plan

• mocha ./test/url.test.ts (3 passing)
• Confirm local ws://localhost relays still skip TLS verify as intended

Made with Cursor

[github-actions]

All contributors have signed the CTA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[SashaMIT]

I have read the CTA Document and I hereby sign the CTA

[SashaMIT]

recheck