Allow macOS proxy loopback for network allowlists

ober

64f7b4f9fe876a3236a6690c61e2a57d1f2c43f4

diff --git a/lib/std/os/limits/sandbox.ss b/lib/std/os/limits/sandbox.ss
index 51de84c..192a6a4 100644
--- a/lib/std/os/limits/sandbox.ss
+++ b/lib/std/os/limits/sandbox.ss
@@ -613,8 +613,10 @@
         [(deny no-internet)
          (display "(deny network-outbound (remote ip))" port)]
         [(allowlist)
-         ;; SBPL can't express host-allowlist; deny remote.
-         (display "(deny network-outbound (remote ip))" port)]
+         ;; SBPL can't express host allowlists. Pair with allow-proxy by
+         ;; allowing only loopback/local socket traffic in the child.
+         (display "(deny network*)" port)
+         (display "(allow network* (local ip))" port)]
         [else (void)])
       (get-output-string port)))