SSRF via potential filter bypass with too lax local domain checking

Summary: Hi. Reviewing the code for filtering for ssrf, in `preventLocalAddress`, we can see that it calls the function `ThrowIfLocalAddress()`. It has three common checks, first, it checks if the string is `localhost`, or if it ends in `.local` or `.localhost`

		// Disallow localhost and local network
		if ($host === 'localhost' || substr($host, -6) === '.local' || substr($host, -10) === '.localhost') {
			$this->logger->warning("Host $host was not connected to because it violates local access rules");
			throw new LocalServerException('Host violates …