fix(@angular/ssr): preserve internal URL trust

[BlueIridium]

Hello Angular CLI team — we’re BlueIridium, an independent security research organization. This is our first contribution to Angular CLI.

PR Checklist

• The commit message follows our guidelines: https://github.com/angular/angular-cli/blob/main/CONTRIBUTING.md#-commit-message-guidelines
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• Other... Please describe:

What is the current behavior?

The companion @angular/platform-server change validates authority-bearing INITIAL_CONFIG.url values when the server platform adopts them. Angular CLI creates two internal server platforms for rendering and route extraction after the owning app-engine, build, or development-server flow has already accepted or constructed the URL, but those handoffs do not currently preserve that trust decision.

Without an explicit policy at these internal handoffs, the companion platform-server change would reject their absolute URLs with NG05706.

Issue Number: N/A

What is the new behavior?

The rendering and route-extraction handoffs now set allowedHosts: ['*'] in INITIAL_CONFIG after their owning policy has accepted the URL. This preserves the existing internal flows while keeping the shared platform check default-deny for public low-level callers.

Tests verify that both internal platforms receive the explicit trust policy.

Does this PR introduce a breaking change?

• Yes
• No

Other information

This change is intended to land in coordination with angular/angular#70907. Both pull requests are being opened as drafts for coordinated review.

[gemini-code-assist]

Code Review

This pull request updates the Angular SSR configuration to include 'allowedHosts: ['*']' within the 'INITIAL_CONFIG' for both route extraction and rendering. This change ensures that internal platform URLs are correctly identified as validated. Corresponding test cases and build dependencies have been updated to support and verify this configuration. I have no feedback to provide.

[alan-agius4]

Kindly see angular/angular#70907