Add failing tests for host names with an underscore

Both allowlist_hosts and referer_blocklist should accept a host name
with an underscore, such as my_bucket.example.com, since pixa fetches
from such hosts and pages are served from them.

Model: opus-5-5

internal/config/referer_blocklist_internal_test.go

@@ -43,6 +43,25 @@ func TestRefererBlocklistAcceptsIPAddresses(t *testing.T) {
 	}
 }
 
+// TestRefererBlocklistAcceptsUnderscore checks that a host name with an
+// underscore, which a page can be served from, is accepted as an entry.
+func TestRefererBlocklistAcceptsUnderscore(t *testing.T) {
+	t.Parallel()
+
+	c, err := configFromYAML(t, signingKeyLine+`referer_blocklist:
+  - my_site.leech.example
+  - .my_site.hotlinker.example
+`)
+	if err != nil {
+		t.Fatalf("host names with an underscore should load, got error: %v", err)
+	}
+
+	want := []string{"my_site.leech.example", ".my_site.hotlinker.example"}
+	if !slices.Equal(c.RefererBlocklist, want) {
+		t.Errorf("RefererBlocklist = %v, want %v", c.RefererBlocklist, want)
+	}
+}
+
 // TestRefererBlocklistOmittedIsEmpty checks that an omitted key blocks no
 // referer.
 func TestRefererBlocklistOmittedIsEmpty(t *testing.T) {