fix: normalize host-only allowed origins to https:// scheme

[Spomky]

Summary

• Host-only entries in allowed_origins (e.g. example.com without scheme) were matched only against the incoming origin's host, bypassing scheme and port validation. This allowed origins like https://example.com:8443 or https://example.com:9999 to pass validation when only example.com was configured.
• Since WebAuthn requires TLS, host-only entries are now normalized to https://{host} in the constructor and go through the full origin match (scheme + host + port), closing this bypass.
• The $hostOrigins property and isSubdomain() helper method are removed as they are no longer needed.

Fixes #817

Test plan

• Existing tests pass — host-only entries like spomky-labs.com with allowSubdomains=true still correctly match subdomains via full origin matching
• Verify that example.com in allowed_origins only matches https://example.com (not https://example.com:8443 or http://example.com)
• Verify that http://localhost explicitly configured still works for development

🤖 Generated with Claude Code