Security bug: Proper subdomain validation against a whitelist

Per https://bugzilla.wikimedia.org/show_bug.cgi?id=69623#c2

Previous code:
return vg.config.domainWhiteList.some(function(d) {
   return d === domain ||
     domain.lastIndexOf("."+d) === (domain.length - d.length - 1);
});

If "."+d doesn't exist in domain, lastIndexOf will return -1.
So if d.length and domain.length are exactly the same length (but different),
then -1 === -1, so the invalid domain would get through.