Improve origin/referer checks

[MegaManSec]

• Separate checks between invalid origin/referer, and insecure.
• Use PSL to check for too-permissive, cross-domain regex patterns.
• Fix some tests, fix the example in the docstring.
• Add check for hostnames being lowercase (conforms to real-world browser situations).
• Report theoretical but impossible for modern browsers as invalid not insecure.
• Add some more tests
• Alerts on invalid $http_referrer usage.

Fixes #41.

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

[MegaManSec]

Note: doesn't pick up the configuration:

map $http_origin $allow_origin {
    ~^https://(.*\.)?example.com$ $http_origin;
    default "";
}
add_header Access-Control-Allow-Origin $allow_origin always;

We can do that once #58 lands.

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud