Support empty AllowedHosts in EgressPolicy for deny-all egress

[JAORMX]

Problem

When WithEgressPolicy is called with an EgressPolicy that has an empty AllowedHosts slice, microvm.Run returns an error:

egress policy: AllowedHosts must not be empty

This prevents callers from expressing a deny-all egress policy. The only way to restrict egress is to list specific allowed hosts, but there is no way to say "allow nothing."

Use Case

In ToolHive, a permission profile with InsecureAllowAll: false and an empty AllowHost list intends to deny all outbound traffic. Currently ToolHive must skip setting the egress policy entirely (resulting in unrestricted egress), which is the opposite of the user's intent.

Proposed Solution

Treat an EgressPolicy with an empty AllowedHosts slice as deny-all rather than rejecting it. When the firewall default action is set to Deny and no hosts are allowed, no outbound connections should be permitted.

Context

Discovered during code review of stacklok/toolhive#4358.