Security hints: opt-in URL reputation providers

[mortenn]

Part of #249 and meta #245.

Scope

Design and implement optional URL reputation provider integrations.

• Start with a provider abstraction and clear provider disclosure.
• Prefer bring-your-own-key integrations for providers with API keys, quotas, or commercial-use constraints.
• Candidate first provider: URLhaus, because it has a focused malware URL use case.
• Possible later providers: Google Web Risk / Safe Browsing, VirusTotal, urlscan.io, PhishTank, or OpenPhish where terms fit.

Acceptance Notes

• Disabled by default and user-triggered unless a future setting explicitly enables automatic checks.
• Clear copy before requests explaining whether the provider receives the host, domain, or full URL.
• Provider API keys stay local and are never logged.
• Handle quotas, 429 responses, provider failures, and inconclusive results without presenting them as security findings.
• Do not automatically call reputation providers when a URL matches Defaults.

Out of Scope

• RDAP domain registration metadata.
• Public CT history.
• Bundling API keys or silently using non-commercial public APIs.