We are also experiencing this same issue on our end and have tried many different combinations including the ones noted in this post. One interesting result we have noted is adding localhost:// seems to completely break the allow list, and opens access to all websites even when not specified within the successfully installed profile.