Function deriveAllowedSuffixes

deriveAllowedSuffixes(
storageApi: { apiUrl: string; downloadUrl: string; s3ApiUrl: string },
): readonly string[]
Extract host suffixes to allow from a B2 authorize-account response.

Derives the parent domain (last two labels) of each realm URL — so api.us-west-004.backblazeb2.com becomes backblazeb2.com. Always includes backblaze.com because upload-pod URLs returned by b2_get_upload_url use that parent domain (pod-NNN-NNNN-NN.backblaze.com) rather than backblazeb2.com.
Parameters
- storageApi: { apiUrl: string; downloadUrl: string; s3ApiUrl: string }
  The apiInfo.storageApi portion of the authorize response.
Returns readonly string[]
Sorted list of unique host suffixes to allow.
- Defined in http/url-guard.ts:126