fix: validate trusted source hosts for SC2

[Bortlesboat]

Summary

• parse candidate URL hostnames before deciding an SC2 fetch source is trusted
• require the hostname to exactly match a trusted domain or be a real subdomain
• add a regression for a malicious URL that only includes github.com in the query string

Why

_is_trusted_source() previously searched the entire matched command text for trusted domains. That allowed an untrusted host such as malicious.evil to be downgraded if github.com appeared in the query string or another non-host part of the URL.

Tests

• uv run pytest tests/unit/test_patterns_new.py -k trusted_domain_in_query -q
• uv run pytest tests/unit/test_patterns_new.py -q
• uv run ruff check src/skillspector/nodes/analyzers/static_patterns_supply_chain.py tests/unit/test_patterns_new.py

Note: the broader non-integration suite still has unrelated Windows-only path separator failures in existing tests. The touched static pattern suite passes.

Closes #110