harden: key remembered site permissions by full origin (closes #402)

allowedSites and deniedSites held the bare hostname, so a grant to
https://dapp.example also authorised http://dapp.example and every port
on that host, and the connection, transaction and signature prompts
named only the hostname. Both lists now store and match the full origin
(scheme://host[:port]), the key the connections approved without
Remember already used. The prompts, the Settings site lists and
AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname
are not migrated (pre-1.0): they match no site.

Model: opus-5-5

tests/coldWorkerSendTransaction.test.js

@@ -29,7 +29,6 @@ const signer = new Wallet(SIGNER_KEY);
 const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 
 const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
 const EXT_URL = "chrome-extension://autistmask/";
 
 const SEPOLIA = networkById("sepolia");
@@ -67,7 +66,7 @@ function storedProfile(networkId) {
         networkId,
         rpcUrl: net.defaultRpcUrl,
         blockscoutUrl: net.defaultBlockscoutUrl,
-        allowedSites: { [signer.address]: [CONNECTED_HOSTNAME] },
+        allowedSites: { [signer.address]: [CONNECTED_ORIGIN] },
         deniedSites: {},
         trackedTokens: [],
     };