Hi,
You can add it to the whitelist per this doc:
NB the HTTPClientRequest class has a lot of bugs in its implementation, one of which is somehow failing to consistently check urlPermission.
Not advising it, but the security is trivially sidestepped by setting the URL to 'marketing.adobe.com' in the constructor call, then changing to anything afterward:
var hcr = new HttpClientRequest('https://marketing.adobe.com');
hcr.url = 'http://localhost/...';
Thanks,
-Jon