Accept apex and www redirects during audits #1058

ts audit treats a redirect between a publisher's apex domain and its www host as a redirect to somewhere else. Auditing example.com when the site canonicalizes to www.example.com (or the reverse) should be the normal, expected case, not something the audit flags.

Where

crates/trusted-server-cli/src/commands/audit/analyzer.rs:60-64 compares the requested URL to the final URL with plain inequality and emits a warning:

if requested_url != final_url {
    warnings.push(format!(
        "page redirected from `{requested_url}` to `{final_url}`"
    ));
}

Any apex-to-www canonicalization produces a warning here, which is noise on most real sites.

What "same publisher origin" should mean

Treat apex and www as the same origin in either direction: example.com ↔ www.example.com. Everything else keeps its current handling:

• A redirect to an unrelated domain still warns.
• An HTTPS-to-HTTP downgrade is still rejected, even between apex and www.
• A redirect to a different subdomain (blog.example.com) is not covered by this issue. Decide whether it should warn, and keep the current behavior if you are unsure; widening that is a separate change.

Before you write a new helper

analyzer.rs:171 already has host_matches, used for classifying assets as first- or third-party:

fn host_matches(page_host: &str, asset_host: &str) -> bool { ... }

It relates a host to its subdomains, which is close to but not the same as apex/www equivalence, and its comment is explicit that it is an advisory heuristic rather than public-suffix-aware. Read it first and decide whether to reuse it, extend it, or add a narrower helper beside it. Reusing it for redirects would silently accept any subdomain redirect as same-origin, which is broader than this issue asks for, so a separate narrow helper is likely the right call. Say which you chose and why.

Acceptance criteria

• Auditing an apex URL that redirects to the www host produces no redirect warning, and the reverse also produces none.
• A redirect to an unrelated domain still warns.
• An HTTPS-to-HTTP downgrade is still rejected.
• The audit's recorded audited_url continues to be the final URL.
• Tests cover apex-to-www, www-to-apex, unrelated-domain, and downgrade cases. analyze_collected_page_uses_final_url_and_records_redirect_warning (analyzer.rs:419) is the test to model.
• ./scripts/test-cli.sh passes (the workspace default target is WebAssembly, so CLI tests need a host target).

Scope note

This is about how the audit interprets a redirect it already followed. It does not change which redirects the browser collector follows: see is_successful_navigation_status in browser_collector.rs and its test at line 367, which already accepts 3xx.