fix: address codeql warning with hostname matches

[JustinBeckwith]

I never write a regex without @alexander-fenster checking me first ...

[bcoe]

This behavior looks a little different, I think we were originally replacing a leading * with ``.

Now we replace a leading *. with ``.

I believe these are the two unit tests that this behavior is meant to facilitate:

    it('should proxy if no_proxy env variable has asterisk, but URL is not matching', async () => {
      const url = 'https://domain.example2.com';
      sandbox.stub(process, 'env').value({
        https_proxy: 'https://fake.proxy',
        no_proxy: '*.example.com',
      });
      const body = {hello: '🌎'};
      const scope = nock(url).get('/').reply(200, body);
      const res = await request({url});
      scope.done();
      assert.deepStrictEqual(res.data, body);
      assert.ok(res.config.agent instanceof HttpsProxyAgent);
    });

    it('should not proxy if no_proxy env variable starts with a dot, and URL partially matches', async () => {
      const url = 'https://domain.example.com';
      sandbox.stub(process, 'env').value({
        https_proxy: 'https://fake.proxy',
        no_proxy: '.example.com',
      });
      const body = {hello: '🌎'};
      const scope = nock(url).get('/').reply(200, body);
      const res = await request({url});
      scope.done();
      assert.deepStrictEqual(res.data, body);
      assert.strictEqual(res.config.agent, undefined);
    });

I'm scratching my head and wondering why the second continues working?

[JustinBeckwith]

The replace passes in a '.' now.

[bcoe]

Can't we get rid of the || url.startsWith('.') then? or what am I missing?

seems like it wouldn't have been doing anything.

[JustinBeckwith]

I was trying to change as little as possible 😆 I don't fully understand what this function does.

[bcoe]

The goal is that if you provide a wild card URL like *.google.com in NO_PROXY, foo.google.com, bar.google.com, etc. should all not be proxied. This is also true of providing .google.com.

[gcf-merge-on-green]

Merge-on-green attempted to merge your PR for 6 hours, but it was not mergeable because either one of your required status checks failed, one of your required reviews was not approved, or there is a do not merge label. Learn more about your required status checks here: https://help.github.com/en/github/administering-a-repository/enabling-required-status-checks. You can remove and reapply the label to re-run the bot.