refactor: extract whitelist package from internal/imgcache

Move HostWhitelist, NewHostWhitelist, IsWhitelisted, IsEmpty, and Count
from internal/imgcache into the new internal/whitelist package.

The whitelist package is completely self-contained, depending only on
net/url and strings from the standard library.

Updated import in internal/imgcache/service.go to use the new package.
Tests moved and adapted to external test style (package whitelist_test).

Part of #39

internal/imgcache/service.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
+	"sneak.berlin/go/pixa/internal/whitelist"
 )
 
 // Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
@@ -20,7 +21,7 @@ type Service struct {
 	fetcher         Fetcher
 	processor       *imageprocessor.ImageProcessor
 	signer          *Signer
-	whitelist       *HostWhitelist
+	whitelist       *whitelist.HostWhitelist
 	log             *slog.Logger
 	allowHTTP       bool
 	maxResponseSize int64
@@ -85,7 +86,7 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		fetcher:         fetcher,
 		processor:       imageprocessor.New(imageprocessor.Params{MaxInputBytes: maxResponseSize}),
 		signer:          signer,
-		whitelist:       NewHostWhitelist(cfg.Whitelist),
+		whitelist:       whitelist.NewHostWhitelist(cfg.Whitelist),
 		log:             log,
 		allowHTTP:       allowHTTP,
 		maxResponseSize: maxResponseSize,