MCP Inspector exempts localhost from its HTTPS check

MCP Inspector's config validation rejected every client metadata URL that wasn't HTTPS, with no carve-out for local testing. It also validated client.json straight off disk, so you couldn't edit around the check once it failed.

That mattered because every test server in the repo runs over plain HTTP. Reproducing a CIMD failure by hand meant standing up a self-signed HTTPS listener with NODE_TLS_REJECT_UNAUTHORIZED=0. Only then could you test anything else.

The exemption fix covers three literal values: localhost, 127.0.0.1, and [::1]. The SDK already exempts that same set elsewhere, so this isn't a new policy. A test in the PR pins the boundary directly: localhost. with a trailing dot still gets rejected, and so does tenant.app.localhost.

For anyone testing CIMD-based flows locally, that boundary matters before you hit it. A dev setup that routes through a subdomain fails the same HTTPS check this PR fixed for bare localhost. The three-literal list closes the bare-localhost case, not the subdomain one.