Fix the URL screen for a link preview endpoint

An AI built a link preview endpoint that fetched any URL a user sent. An attacker could send http://169.254.169.254/latest/meta-data/ to read the cloud instance's credentials, or reach internal services on localhost. This is server-side request forgery (SSRF). Your team now screens every preview URL before the server fetches it. A production guard also checks the address the host name resolves to and refuses redirects; this check is the part that needs no network.

An assistant wrote screen_preview_urls(urls, allowed_hosts). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• urls: the URLs users sent.
• allowed_hosts: the domains previews may come from.
• Return one verdict per URL, in order: "allow", "block:scheme", "block:private_ip" or "block:host_not_allowed".

Rules the tests check:

• Trim whitespace from each URL and each allowed host, and lowercase the allowed hosts. Ignore empty allowed hosts.
• The scheme is the text before the first ://, lowercased. With no ://, or with a scheme other than https: "block:scheme".
• Find the host in the text after that ://, in this order:
  1. Cut it at the first /, ? or #. What is left is the authority.
  2. If the authority contains @, keep only what comes after its last @. The part before it is a user name and password, not the host.
  3. Cut at the first : to drop the port, then lowercase.
• "block:private_ip": the host is localhost, ends with .localhost, .internal or .local, or is a private IPv4 address. That is four parts separated by ., each 1 to 3 digits and at most 255, where the first part is 0, 10 or 127, or the first two parts are 172 and 16 to 31, or 192 and 168, or 169 and 254.
• Otherwise "allow" when the host equals an allowed host or ends with . followed by one. Anything else: "block:host_not_allowed".