feat: add URL safety coordinator for navigation and bookmark flows

[skrushna1704]

Introduces centralized URL trust, redirect tracking, and bookmark normalization wired through navigation, tabs, and share-import paths.

[kododake]

Thank you for the PR. While the goal of introducing centralized URL trust checks, redirect tracking, and bookmark normalization is highly beneficial, there are several critical security vulnerabilities and functional bugs that need to be addressed before this can be merged.

1. Critical Security Vulnerability: Insufficient Domain Validation
   In UrlSafetyCoordinator.kt, the method isTrustedNavigationTarget uses host.contains(trustedRoot) to verify trusted domains. This partial match allows malicious hosts like "google.com.attacker.com" or "attacker-youtube.com" to be incorrectly classified as trusted targets. This bypasses the cleartext HTTP warning dialog without user consent, exposing users to MITM and phishing attacks.

• Fix: Use exact matches or subdomain suffixes: host == trustedRoot || host.endsWith(".$trustedRoot").

2. Critical Functional Bug: Broken Relative Redirect URL Resolution
   In UrlSafetyCoordinator.kt, resolveRedirectTarget uses appendEncodedPath to resolve relative redirect paths. This incorrectly appends paths to the end of the current URL. For example, redirecting from "https://example.com/app/dashboard" to "/login" results in "https://example.com/app/dashboard/login" instead of the expected "https://example.com/login". The unit test resolveRedirectTarget_supportsRelativePaths misses this because it only checks if the result is not blank.

• Fix: Use java.net.URI's resolve() method to properly handle relative and absolute paths.

3. UX Bug: Incorrect Toast Message on Duplicate Batch Bookmark Import
   In ShareBookmarkActivity.kt, importing a batch of bookmarks always triggers the bookmark_added toast, even if all imported bookmarks were duplicates and no new bookmarks were actually added.

• Fix: Compare the size of the merged list with the existing list, and only show the success toast if the count increases.

4. Thread-Safety and Test Isolation Issues

• UrlSafetyCoordinator.sessionTrustedHosts is defined as a non-thread-safe mutableSetOf(). Since UrlSafetyCoordinator is a singleton, concurrent access could throw ConcurrentModificationException. Please use a thread-safe set (e.g., ConcurrentHashMap.newKeySet()).
• The tests in UrlSafetyCoordinatorTest modify the singleton's state (like redirect depth) but do not guarantee cleanup if an assertion fails. Please add cleanup logic in @After to prevent test contamination.

Please address these issues and update the PR.