[HttpListener] Only bind to the specified hosts (and support '*' as Any), fixes #17204, #10818