fix(mxc): allow explicit sandbox-local TCP loopback

[araza008]

Summary

Adds pc_allow_loopback to enable sandbox-local TCP without unrelated network rules, fixing the WebSocket demo’s WSAEACCES failures while keeping host-loopback and private-network ingress denied. It checks permission when forwarding is requested, allows sandbox creation without the grant, and updates the demo, regression tests, and documentation.

Changes

• Add pc_allow_loopback without enabling host-loopback or private-network ingress.
• Check effective loopback permission when forwarding, while allowing sandbox creation.
• Update the WebSocket demo configuration and listener readiness checks.
• Add driver and native regression coverage and document the network grants.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.