kojiapi: add domain allowlist

This commit adds a domain allowlist which works the same way as the one
for remote workers.

To accept just w1.osbuild.org and w2.osbuild.org, use:

[koji]
domain_allowlist = [ "w1.osbuild.org", "w2.osbuild.org" ]

cmd/osbuild-composer/main.go

@@ -79,6 +79,7 @@ func main() {
 					KeyTab    string `toml:"keytab"`
 				} `toml:"kerberos,omitempty"`
 			} `toml:"servers"`
+			AllowedDomains []string `toml:"allowed_domains"`
 		} `toml:"koji"`
 		Worker *struct {
 			AllowedDomains []string `toml:"allowed_domains"`
@@ -213,6 +214,7 @@ func main() {
 			CACertFile:     "/etc/osbuild-composer/ca-crt.pem",
 			ServerKeyFile:  "/etc/osbuild-composer/composer-key.pem",
 			ServerCertFile: "/etc/osbuild-composer/composer-crt.pem",
+			AllowedDomains: config.Koji.AllowedDomains,
 		})
 		if err != nil {
 			log.Fatalf("TLS configuration cannot be created: " + err.Error())

test/image-tests/osbuild-composer.toml

@@ -1,3 +1,6 @@
+[koji]
+allowed_domains = [ "localhost", "*.osbuild.org" ]
+
 [koji.servers.localhost.kerberos]
 principal = "osbuild-krb@LOCAL"
 keytab = "/etc/osbuild-composer/client.keytab"