feat: support dynamic port matching for localhost redirect URIs

[roncodingenthusiast]

Add localhost handling to isLoopbackAddress so that native OAuth 2.0 clients registering http://localhost/callback can use dynamic ports (e.g. http://localhost:54321/callback) for loopback redirect URIs.

Previously, isLoopbackAddress only used net.ParseIP which returns nil for the hostname "localhost", preventing port-flexible loopback matching. The existing hostname equality check in isMatchingAsLoopback prevents cross-matching between localhost and IP literals.

Related Issue or Design Document

#873

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact security@ory.sh) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

RFC 8252 §7.3 strictly defines loopback redirect URIs using IP literals only, and §8.3 says localhost is NOT RECOMMENDED. However, Fosite already accepts localhost as a valid loopback host for transport security purposes via IsLocalhost. This one-line change aligns isLoopbackAddress (used for port matching) with that existing decision, unblocking real-world MCP/OAuth clients that register http://localhost/callback by convention.

Test cases added:

• http://localhost:9999/callback matches registered http://localhost/callback (dynamic port)
• http://localhost/callback matches itself (exact match)
• http://localhost:9999/callback does NOT match registered http://127.0.0.1/callback (hostname mismatch)
• http://127.0.0.1:9999/callback does NOT match registered http://localhost/callback (hostname mismatch)

[CLAassistant]

All committers have signed the CLA.