Restricted-Module IP Allow-Lists Can Name a Whole Network

A restricted-module IP allow-list entry can now name a whole network (for example a /24 or an IPv6 /56) as well as a single host or a wildcard, so something like an IPv6 kiosk can be admitted. A few smaller allow-list issues were fixed along the way.