Implement the intended behavior to always allow localhost host for
development convenience. The isHostAllowed method had a comment
stating localhost should always be allowed, but the code did not
implement this check.

This fixes the issue where no-cors cross-site requests to localhost
were incorrectly blocked with 403 Forbidden. Now localhost is always
allowed regardless of allowedHosts configuration, matching the
intended behavior for development environments.

Fixes the cross-origin-header-check middleware blocking legitimate
localhost requests from blob URLs and other cross-origin contexts.

Fixes webpack#5603

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>