sanitize build slugs against path injection and match registry domains on parsed hostname

[rempairamore]

1. Path injection in static site builder (py/path-injection, alerts #12 - #20 )

_rel_slug() built the output path of each resource page directly from
the prefix and local name of IRIs in the loaded ontology - i.e. from
user-controlled input. An ontology containing an IRI whose local part
was e.g. "../../../../etc/x" would make build_html() create directories
and write .html/.ttl/.rdf files outside the build directory.

• New safe_segment() whitelists every slug segment ([A-Za-z0-9.-],
  '-' for everything else), strips leading/trailing '.'/'-' so '..'
  can never survive, and caps length at 100 chars. A segment reduced
  to empty is treated as "namespace IRI, no local part" and the page
  is skipped, same as before.
• Defense in depth: build_html() additionally resolves each target
  path and skips it unless it is inside the resources directory.
• Slugs are sanitized at the source (_rel_slug), so generated links
  (resource_url_index/resource_url_resource) and file paths stay
  consistent.

2. Incomplete URL substring sanitization (py/incomplete-url-substring-

sanitization, alert #3)

_is_likely_ontology() matched registry domains with a substring check
on the whole URL, so "https://evil.com/w3id.org/x" was classified as
a trusted ontology registry. It now matches the parsed hostname
exactly (or as a subdomain), and the W3C namespace check matches
against the URL path instead of the raw string. Impact was limited to
the is_visualizable UI flag - the API re-validates URLs on load - but
the check is now correct.