Hyperlight blockedHosts overrides defaultPolicy=block

> ⚠️ **Security notice:** When reporting BSODs or security issues, **DO NOT** attach memory dumps, logs, or traces to GitHub issues. Instead, send them to secure@microsoft.com referencing the GitHub issue. For application crashes, include a Feedback Hub link if possible (open with Win+F, choose "Share My Feedback" after submission).

### Relevant area(s)
Windows

### Brief description of your issue

The Hyperlight backend treats a non-empty `network.blockedHosts` list as an allow-by-default blocklist even when `network.defaultPolicy` remains at its secure default of `block`. This silently widens the requested network boundary and contradicts the meaning of `defaultPolicy=block`.

### Steps to reproduce
1. Run a Hyperlight sandbox with `network.defaultPolicy` omitted or set to `block`.
2. Add one entry to `network.blockedHosts`.
3. Attempt network access to a destination not in `blockedHosts`.

### Expected behavior

`network.defaultPolicy=block` remains authoritative. `blockedHosts` must not enable networking to every unlisted destination; the backend should either preserve block-by-default semantics or reject the incompatible policy combination.

### Actual behavior

`network_policy_from_request` selects Hyperlight's `BlockList` whenever `blockedHosts` is non-empty, before checking `defaultPolicy`. The resulting policy allows all destinations except the listed hosts. The generic boundary-relaxation audit also omits `blockedHosts`, so this backend-specific relaxation is not logged.