refactor: consolidate target hostname and path validation

[devUmut35]

Summary

Hostname and origin-relative path validation were duplicated across three modules with slightly different messages:

• scanner.py validated hostnames after IDN encoding
• network.py normalized + validated hostnames itself
• policy.py re-implemented both hostname normalization and path validation

This PR extracts one canonical implementation into a new previewshield.targets module:

• normalize_hostname() - IDN normalization, IP compression, label/length checks (raises ValueError)
• normalize_origin_paths() - safe origin-relative route parsing, query preservation, deduplication

Each caller keeps its own public error contract (ConfigurationError for scanner/policy, NetworkSafetyError for network) by translating the shared ValueError.

Net result: 19 insertions / 90 deletions of duplicated safety logic removed.

Behavior compatibility

• All 195 existing tests pass unchanged; coverage stays at 87.46%.
• Error messages for pinned cases are preserved (e.g. policy path errors still contain "origin-relative" / "Unsafe route", allowed-host errors still say "Invalid allowed host").
• Scanner still rejects %-bearing and underscore hostnames with the same message as before.

Verification

• python -m pytest → 195 passed
• python -m ruff check src tests → clean
• python -m ruff format --check src tests → clean