Say the source host is signed as the URL writes it (part of #246)

The Signature Specification read as though the hostname were signed
with ":" and the port appended. The code signs the host segment as the
URL writes it up to the first "/", lower-cased, so IPv6 brackets and a
":" with or without a port are kept. The README line, the TODO.md entry
and the parser comment now say so.

Model: opus-5-5

internal/imgcache/urlparser.go

@@ -151,7 +151,8 @@ func parseImageComponents(remainder string) (*ParsedURL, error) {
 	}
 
 	// Host names do not depend on letter case, so the allowlist, the upstream
-	// connection limits and the cache see one spelling of each host
+	// connection limits, the cache and the signature see one spelling of each
+	// host
 	host = strings.ToLower(host)
 
 	// Extract query string if present in path