fix: use hostname to check against allowlist

[AugmentedMode]

Explanation

The current implementation of the PhishingController uses the full origin (Punycode encoded) to check against the allowlist. This approach has limitations when dealing with subdomains or variations in the URL structure, which could lead to inconsistent results or false negatives.

The changes introduced in this PR address these issues by extracting the hostname from the origin and checking the allowlist against this hostname instead of the full origin. This ensures that variations in the URL structure do not prevent legitimate domains from being correctly recognized as safe.

Specifically, this PR:

• Modifies the test, isBlockedRequest, and bypass methods to use the hostname for allowlist checks.
• Adds a new utility function, getHostnameFromUrl, which extracts the hostname from a given URL. This function is now used across the PhishingController to standardize how hostnames are derived from origins.

These changes ensure that domains are properly validated against the allowlist regardless of URL variations.

References

Changelog

@metamask/phishing-controller

• CHANGED: Updated test, isBlockedRequest, and bypass methods to use the hostname for allowlist checks instead of the full origin.
• ADDED: Introduced getHostnameFromUrl utility function to standardize hostname extraction from URLs.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've highlighted breaking changes using the "BREAKING" category above as appropriate