fix: Domain allowance check to require exact matches (#39752)

Co-authored-by: Diego Sampaio <chinello@gmail.com>

Author: ggazzo

.changeset/eight-colts-kiss.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/federation-matrix": patch
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue on Federation where all domains ending with the pattern where being allowed to communicate, the feature is meant to work with a list, url by url

ee/packages/federation-matrix/src/api/middlewares/isFederationDomainAllowed.ts

@@ -52,8 +52,8 @@ export const isFederationDomainAllowedMiddleware = createMiddleware(async (c, ne
 		return c.json({ errcode: 'M_MISSING_ORIGIN', error: 'Missing origin in authorization header.' }, 401);
 	}
 
-	// Check if domain is in allowed list
-	if (allowList.some((allowed) => domain.endsWith(allowed))) {
+	// Check if domain is in allowed list (exact match only)
+	if (allowList.some((allowed) => domain === allowed)) {
 		return next();
 	}