Fix ISPN localhost binding filtering

[ShiroKSH]

Summary

• Filter localhost Docker port bindings in ISPN mode without modifying the slice being ranged over.
• Delete empty port entries after filtering so dropped localhost ports are not exposed.
• Add regression coverage for localhost rewrite and ISPN drop behavior.

Tests

• GOOS=linux GOARCH=amd64 GOPROXY=direct go test -c ./environment