support allowed_hosts list

[stdweird]

I am facing an error with remote accessing a containerised setup.
The codesearch log shows WARN rmcp::transport::streamable_http_server::tower: rejected request with disallowed Host header (possible DNS rebinding attempt) host=NormalizedAuthority

This seems to lead back to
GHSA-89vp-x53w-74fx

I think i need to be able to set the expected remote hostname as the allowed_hosts via some internal code magic; and this via a new env variable

[stdweird]

not saying this must be supported; hosting this behind an nginx is probably better, if only for the https handling (but this is internal testing, so you might consider adding it)

[flupkede]

Fixed in #157 — thanks for flagging this, @stdweird! Added CODESEARCH_ALLOWED_HOSTS and CODESEARCH_DISABLE_HOST_VALIDATION env vars so containerised deployments can override rmcp's loopback-only default allowlist.