Support wildcard entries in SSO return_domain_whitelist

[benidk]

Description

return_domain_whitelist only accepts exact hostnames, with no wildcard support, which is a problem for HTTP targets since their subdomains aren't a fixed known set.

This adds support for a *. prefix in whitelist entries, matching any subdomain of the given base (but not the bare domain itself), e.g. *.bastion.example.com. Plain entries keep matching exactly as before.

AI Usage

Choose the level of AI involvement for this PR.

• Fully vibe coded
• AI-designed, AI-coded, manually checked
• Human-designed, AI-coded
• Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

_{This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).}