Scope cookies to the host that set them

[rzo1]

CookieConverter only checked applicability for cookies carrying a Domain attribute. A cookie without one, which is the usual session cookie, skipped the check and was sent to whatever host was being fetched. The domain check also passed on exception and accepted a Domain covering every host under it, such as com or co.uk.

A three-argument getCookies taking the originating URL is added; the two-argument method is deprecated and kept. A Domain attribute is now normalised with IDN.toASCII and validated before use, so the unicode and punycode forms of a name are interchangeable and a malformed value such as com.. is rejected instead of matching every host under com. The public suffix list already shipped with crawler-commons, private section included, decides whether a domain may cover subdomains at all; a domain the list does not know about, e.g. an internal name under .local, falls back to the plain suffix match so unlisted domains keep working. A domain which cannot own subdomains is ignored and the cookie is bound to the host, per RFC 6265 5.3. An address is matched only by itself, per RFC 6265 5.1.3, where Domain=2.3.4 previously covered 9.2.3.4.

Two smaller ones found on the way: a Set-Cookie header whose first token has no = threw StringIndexOutOfBoundsException out of getCookies and failed the whole fetch, and is now skipped; cookies dropped on the path, secure and expiry checks are logged like the other ones.

The protocols record which host set the cookies. When a response carries Set-Cookie, okhttp and playwright write its URL alongside as set-cookie-origin, dropping any inbound key of that name first so a response cannot choose where its cookies are sent. That key has to travel with protocol.set-cookie for host-only cookies to be sent back, so it is added to the metadata.persist and metadata.transfer examples and a warning naming both keys is logged once when cookies arrive without it. Also corrects the metadata.transfer example in internals.adoc, which named set-cookie where the key is protocol.set-cookie.

For all changes

• Is there a issue associated with this PR? Is it referenced in the commit message? - no issue

• Does your PR title start with #XXXX where XXXX is the issue number you are trying to resolve? - no issue

• Has your PR been rebased against the latest commit within the target branch (typically main)?

• Is your initial contribution a single, squashed commit?

• Is the code properly formatted with mvn git-code-format:format-code -Dgcf.globPattern="**/*" -Dskip.format.code=false?

For code changes

• Have you ensured that the full suite of tests is executed via mvn clean verify? - core module tests only
• Have you written or updated unit tests to verify your changes? - CookieConverterTest extended
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0? - no new dependencies
• If applicable, have you updated the LICENSE file, including the main LICENSE file? - n/a
• If applicable, have you updated the NOTICE file, including the main NOTICE file? - n/a

[dpol1]

Two things before merging: the new domain guard is bypassable, and the null origin disables every host-only cookie (no Domain, in practice most session cookies) for anyone running http.use.cookies. Threads.

Side note on "both protocol implementations": httpclient went with #2071, only okhttp calls this now.