Restricted-Module IP Allow-Lists Can Name a Whole Network

A restricted-module IP allow-list entry can now name a whole network, for example a /24 or an IPv6 /56, as well as a single host or a wildcard, so something like an IPv6 kiosk can be allowed in. Several smaller allow-list issues were fixed in the same release.