Fix reversed str_ends_with in localhost detection

[Firehed]

WildcardRelyingParty determines whether an rpId is local (and therefore exempt from the https requirement) with:

str_ends_with('.localhost', $rpId) => true,

The arguments are transposed. This asks whether the literal string .localhost ends with $rpId, not whether $rpId is a .localhost subdomain.

Two consequences:

.localhost subdomains are not recognized as local. new WildcardRelyingParty('app.localhost') gets isLocal = false, so matchesOrigin('http://app.localhost:3000') returns false. This is the case the match arm exists to support.

A narrow set of rpIds are wrongly treated as local. The only values that satisfy the reversed check are suffixes of .localhost: t, st, ost, host, lhost, alhost, calhost, ocalhost, localhost, .localhost. An RP configured with rpId host gets isLocal = true and accepts plaintext http:// origins.

The fix restores the intended direction, using named arguments to match the call already on line 56 of the same file.

Existing coverage passed because every localhost vector in the data provider uses rpId localhost exactly, which the preceding $rpId === 'localhost' arm already handles — the reversed arm was never exercised for its intended purpose. Three vectors are added: two .localhost subdomain rpIds, and host as a guard against the suffix behavior.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.48%. Comparing base (96e6cc3) to head (82ced82).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #102   +/-   ##
=========================================
  Coverage     81.48%   81.48%           
  Complexity      343      343           
=========================================
  Files            33       33           
  Lines           994      994           
=========================================
  Hits            810      810           
  Misses          184      184           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.