fix: a request whose origin has no host is refused, not treated as a site (closes #527)

A page with an opaque origin, such as one its server sandboxes with a
Content-Security-Policy, is reported to the background with the origin
"null", and Chrome reports a local file as "file://". The background took
either as a site, so every such page was one site: a connection remembered
for one covered them all, and the phishing check never matched. The
background now parses the reported origin and, when it has no host, refuses
the request with 4100 like one with no origin, before any method runs.
tests/rpcOrigin.test.js sends both, and README's SiteApproval says what is
refused.

Model: opus-5-5

src/background/index.js

@@ -1457,7 +1457,14 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         // the message carries. Firefox before 126 gives no sender.origin, so
         // the origin of sender.url is used: the frame that sent the message,
         // not the tab's page, which may be another site embedding that
-        // frame. With neither, the request is refused.
+        // frame.
+        //
+        // A site is scheme://host[:port], so a request is refused when its
+        // origin has no host, as when it has no origin at all, rather than
+        // credited to the site its URL names. The browser reports "null" for
+        // a page with an opaque origin, such as one its server sandboxes with
+        // a Content-Security-Policy, and Chrome reports "file://" for a local
+        // file.
         let trustedOrigin = sender.origin;
         if (!trustedOrigin && sender.url) {
             try {
@@ -1466,7 +1473,13 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // an unparseable URL leaves the origin unknown
             }
         }
-        if (!trustedOrigin) {
+        let host = "";
+        try {
+            host = new URL(trustedOrigin).host;
+        } catch {
+            // no origin, or "null", is not a URL and so has no host
+        }
+        if (!host) {
             sendResponse({
                 error: {
                     code: 4100,