egress(allowlist): add adsbynimbus-public.s3.amazonaws.com

[JasonSznol]

What are you trying to accomplish?

This change adds the exact public Ads By Nimbus S3 host, adsbynimbus-public.s3.amazonaws.com, to the default egress allowlist.

This is required because the host is serving public package/assets content and is being blocked by the shared egress allowlist in enforce mode. The host is a fixed public S3 bucket and should be allowlisted as an exact hostname only, not widened to a suffix or glob pattern.

Anything you want to highlight for special attention from reviewers?

This host is added as an exact entry rather than a wildcard or leading-dot form to match the project’s security model for shared object storage. A broader match would risk allowing attacker-controlled sibling buckets or subdomains under the same parent namespace.

The change also includes a guardrail regression test to ensure the exact host remains exact and does not widen to a broader domain match in the future.

Google Play Store SDK Listing - https://play.google.com/sdks/details/com-adsbynimbus-android-nimbus
iOS Swift Package - https://github.com/adsbynimbus/nimbus-ios-sdk

How will you know you've accomplished your goal?

The allowlist change is validated by the egress allowlist tests, including:

• a positive probe for the exact host
• a positive probe for the maven repository
• a child-host regression probe ensuring the entry does not broaden to evil.adsbynimbus-public.s3.amazonaws.com

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.