feat: restrict default allowed domains (#217)

The agent used to allow github.com, api.github.com and
*.blob.core.windows.net by default as a convenience. Given these domains
allow anyone to easily use as exfiltration destination, Bullfrog egress
filtering could be easily bypass in jobs, even when egress to github
wasn't required.

This is a breaking change because some users might have use bullfrog in
jobs that require egress to github.com or api.github.com without the
domains being explicitly allowed. After this change, github.com and
api.github.com will need to be explicitly allowed in bullfrog.

Author: fallard84

agent/agent.go

@@ -14,8 +14,31 @@ import (
 )
 
 var (
-	blocking          = false
-	defaultDomains    = []string{"github.com", "api.github.com", "*.actions.githubusercontent.com", "results-receiver.actions.githubusercontent.com", "*.blob.core.windows.net", "*.githubapp.com"}
+	blocking       = false
+	defaultDomains = []string{
+		"*.actions.githubusercontent.com",
+		"*.githubapp.com",
+		"glb-*.github.qkg1.top",
+		"productionresultssa1.blob.core.windows.net",
+		"productionresultssa2.blob.core.windows.net",
+		"productionresultssa3.blob.core.windows.net",
+		"productionresultssa4.blob.core.windows.net",
+		"productionresultssa5.blob.core.windows.net",
+		"productionresultssa6.blob.core.windows.net",
+		"productionresultssa7.blob.core.windows.net",
+		"productionresultssa8.blob.core.windows.net",
+		"productionresultssa9.blob.core.windows.net",
+		"productionresultssa10.blob.core.windows.net",
+		"productionresultssa11.blob.core.windows.net",
+		"productionresultssa12.blob.core.windows.net",
+		"productionresultssa13.blob.core.windows.net",
+		"productionresultssa14.blob.core.windows.net",
+		"productionresultssa15.blob.core.windows.net",
+		"productionresultssa16.blob.core.windows.net",
+		"productionresultssa17.blob.core.windows.net",
+		"productionresultssa18.blob.core.windows.net",
+		"productionresultssa19.blob.core.windows.net",
+	}
 	defaultIps        = []string{"168.63.129.16", "169.254.169.254", "127.0.0.1"}
 	defaultDNSServers = []string{"127.0.0.53"}
 )

agent/agent.sha256

@@ -1 +1 @@
-72fdea56ef365e362fd5ae69c1d5866fc4636db4e8e4aa10855d158d3f5e439f  agent
+b6f598a15855507d5c95bf2b047cd1a0210a1fb1fecf2fc63fefdf8d4cb48c63  agent