Improve DNS rebinding fix with IPv6 private range checks

[ACK-J]

Builds on #73 to close the DNS rebinding bypass (#69).

Changes

• Replace local_filter regex with URL parsing — isLocalRequestUrl() uses the URL API and global/privateAddress.js instead of regex-matching raw URL strings.
• DNS rebinding protection — resolve domain hostnames via browser.dns.resolve() and block when any address is private.
• IPv6 coverage — loopback (::1), link-local (fe80::/10), ULA (fc00::/7), IPv4-mapped private addresses.
• Safer hostname handling — exact localhost matching (excludes localhost.example.com), trailing-dot FQDN normalization, browser-normalized IPv4 forms.
• Fix url.hostname for DNS — use url.hostname (not url.host) so URLs with ports like http://example.com:8080 resolve correctly.
• Skip DNS for literal IPs — public IP literals skip redundant DNS lookups; private literals are caught by isLocalRequestUrl().

Review fixes (latest)

Issue	Fix
browser.dns.resolve(url.host) included port, causing fail-open	Changed to url.hostname
Redundant DNS on http://8.8.8.8	Skip DNS when hostname is a literal IP
Duplicated block logic	Extracted blockPortScan() helper

Behavior improvements over old regex

URL	Old regex	This PR
http://localhost.example.com	blocked (false positive)	allowed
http://[::1]:8080	missed	blocked
http://localtest.me (DNS→127.0.0.1)	missed	blocked
http://rebinding.local:8080 via /etc/hosts→192.168.1.1	missed	blocked

Testing

# Unit checks
node --input-type=module -e "import { isLocalRequestUrl, isPrivateAddress } from './global/privateAddress.js'; ..."

# Manual (Firefox): load temp add-on, from external page console:
fetch('http://localtest.me').catch(() => {});
# → extension popup badge increases, background log: "DNS resolved to private address"

Closes #69. Supersedes #73.