Seems worthwhile to have some basic unit tests to test the (sub)domain matching of $wgCopyUploadsDomains and specifically handling of foo.*.domain.tld when *.domain.tld is whitelisted
From the example of T225852 where *.nasa.gov is whitelisted, but svs.gsfc.nasa.gov isn't allowed. As a workaround (or to keep a strict limitation) *.jpl.nasa.gov is explicitly whitelisted