guest agent: add --allow-rpcs / whitelist mode