#3695 test: make network-dependent unit tests hermetic

Refs PFM-7940

Summary

Two unit tests made live outbound HTTP calls, so they failed on any runner without internet egress (air-gapped CI, outages, rate limits). This makes them not need the network at all, reusing loopback patterns already present in the repo.

• rego (pkg/policies/engine/rego): replace the two "allowed network requests" subtests that dialed www.chainloop.dev and github.com with TestRego_AllowedHostnames (asserts allow-list membership) and TestRego_AllowedHostIsReachable (reaches an allowed host on a loopback httptest server). The forbidden functions/forbidden network requests subtests are unchanged. Drops the now-unused restricted_mode_networking_allowed_host.rego testfile.
• materials (pkg/attestation/crafter/materials): replace the non-existent path OCI case that reached Docker Hub for its UNAUTHORIZED response with TestOCIImageCraft_UnresolvableRemoteReference against an in-memory loopback registry, asserting the deterministic NAME_UNKNOWN error.

No production behavior changes. The engine's host allow-list, netguard ranges, and http.send gating are untouched. The fix lives entirely in test code.