Trim trailing dot and normalize case for trusted IMDS hostnames

DNS resolvers may return hostnames with a trailing dot (e.g.
`metadata.google.internal.`), which is a valid FQDN form. The previous
direct equality check failed to match these, so they would not be
skipped and could cause false-positive stored-SSRF blocks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bitterpanda63

aikido_zen/vulnerabilities/ssrf/imds.py

@@ -29,7 +29,7 @@ def is_trusted_hostname(hostname):
     """
     If the hostname is a trusted host (like metadata.goog), there was no spoofing of hostnames, so it's not an attack
     """
-    return hostname in trusted_hosts
+    return hostname.lower().rstrip(".") in trusted_hosts
 
 
 def resolves_to_imds_ip(resolved_ip_addresses, hostname):

aikido_zen/vulnerabilities/ssrf/imds_test.py

@@ -21,6 +21,9 @@ def test_is_imds_ip_address_ipv6_mapped():
 def test_trusted_hostname_returns_none():
     """Test that trusted hostnames always return None."""
     assert resolves_to_imds_ip(["1.1.1.1"], "metadata.google.internal") is None
+    assert resolves_to_imds_ip(["169.254.169.254"], "metadata.google.internal.") is None
+    assert resolves_to_imds_ip(["169.254.169.254"], "metadata.goog.") is None
+    assert resolves_to_imds_ip(["169.254.169.254"], "METADATA.GOOGLE.INTERNAL") is None
 
 
 def test_aws_imds_ipv4_present_returns_ip():