fix(website-policy): scope disabled cache fast path

[kriss39]

What does this PR do?

This fixes a small cache bug in the website blocklist logic.

load_website_blocklist() already checks that a cached policy belongs to the current profile and is still within the cache TTL. However, check_website_access() had a separate fast path for disabled policies that skipped those checks.

That could cause two problems:

• In a multiplexed process, a disabled policy cached for one profile could affect another profile.
• If the blocklist was disabled and then enabled in config.yaml, the old disabled cache could continue to be used even after its TTL expired.

The fix keeps the fast path, but makes it use the same path + TTL validation as the normal cache lookup.

This is related to #58526, which fixed the main cache lookup, but the disabled-policy shortcut was still bypassing that logic.

Changes

• Added a small helper for validating cached website policies.
• Reused it in both the normal cache lookup and the disabled-policy fast path.
• Added regression tests for:
  • switching between profiles with different website policies
  • reloading the policy after the disabled cache expires

Testing

I reproduced both cases against the current main behavior.

Before the fix:

2 failed

With this change:

2 passed

I also ran:

python -m py_compile tools/website_policy.py tests/tools/test_website_policy_cache_scope.py

which passed.

I also searched existing issues and PRs before opening this. #52082 has related website-policy cache tests, but it does not cover the cross-profile disabled-cache case or the expired disabled-cache path fixed here.