static List<AllowedUrn> readAllowedUrns(Element endpointElement, Optional<String> zoneEndpointType, String containerId, String msgPrefix) {
        List<AllowedUrn> allowedUrns = new ArrayList<>();
        for (var allow : XML.getChildren(endpointElement, "allow")) {
            if (zoneEndpointType.isEmpty() || ! zoneEndpointType.get().equals("private"))
                illegal(msgPrefix + "only endpoints of type 'private' can specify 'allow' children");

            switch (requireStringAttribute("with", allow)) {
                case "aws-private-link" -> allowedUrns.add(new AllowedUrn(AccessType.awsPrivateLink, requireStringAttribute("arn", allow)));
                case "gcp-service-connect" -> allowedUrns.add(new AllowedUrn(AccessType.gcpServiceConnect, requireStringAttribute("project", allow)));
                default -> illegal("Private endpoint for container-id '" + containerId + "': " +
                                   "invalid attribute 'with': '" + requireStringAttribute("with", allow) + "'");
            }
        }
        return allowedUrns;
    }
@param parentElement
@param endpointElement
@param level decide what this method is reading TODO: Split into different methods instead
@param instance the instance this applies to, or empty if it does not apply to an instance (application endpoints)
@param steps
@param forRegions the regions this applies to (for bcp), or empty (otherwise) to read this from "region" subelements
@param endpointsByZone a map containing any zone endpoints read by this
@return the endpoint read, unless it is added to endspointsByZone instead *sob*
config-model-api/src/main/java/com/yahoo/config/application/api/xml/DeploymentSpecXmlReader.java