When using the JCasC `ScriptApproval` argument the approvedSignatures don't seem to actually get applied until after Jenkins is restarted. More info here
For me it worked properly on Jenkins 2.190, casc plugin 1.36 and Script Security plugin 1.68.
security: scriptApproval: approvedSignatures: - method java.net.URI getHost