Skip shared infrastructure in domain matching

The deterministic tracker-mapping heuristics group patterns by shared
initiator domain, but tag managers, customer-data platforms, and
generic CDNs (Google Tag Manager, Segment, cloudfront.net, ...)
initiate trackers for many unrelated vendors. Grouping on such a
domain mis-attributes one vendor's tracker to another.

Add uri.FilterSharedInfrastructureDomains backed by a curated eTLD+1
denylist and apply it once in resolveDeterministic, so sibling
grouping, catalog domain matching, and the sibling re-enqueue cascade
all ignore shared-infrastructure hosts. Vendor-specific domains such
as google-analytics.com are intentionally kept as a same-vendor
signal. The agent path is unchanged: it still sees observed domains,
now with a prompt caveat about shared infrastructure.

Update the two sibling tests that used googletagmanager.com as the
initiator domain to a vendor domain, since that host is now stripped
before grouping.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/uri/uri_test.go

@@ -364,3 +364,56 @@ func TestFilterFirstPartyDomains(t *testing.T) {
 		})
 	}
 }
+
+func TestFilterSharedInfrastructureDomains(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		domains []string
+		want    []string
+	}{
+		{
+			name:    "removes tag manager domain",
+			domains: []string{"googletagmanager.com", "posthog.com"},
+			want:    []string{"posthog.com"},
+		},
+		{
+			name:    "removes generic cdn domain",
+			domains: []string{"cloudfront.net", "hotjar.com"},
+			want:    []string{"hotjar.com"},
+		},
+		{
+			name:    "keeps vendor-specific domains",
+			domains: []string{"google-analytics.com", "stripe.com"},
+			want:    []string{"google-analytics.com", "stripe.com"},
+		},
+		{
+			name:    "case insensitive match",
+			domains: []string{"GoogleTagManager.com", "Segment.IO"},
+			want:    []string{},
+		},
+		{
+			name:    "mixed infra and vendor",
+			domains: []string{"gstatic.com", "doubleclick.net", "jsdelivr.net"},
+			want:    []string{"doubleclick.net"},
+		},
+		{
+			name:    "empty domains list",
+			domains: []string{},
+			want:    []string{},
+		},
+		{
+			name:    "nil domains list",
+			domains: nil,
+			want:    []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tt.want, FilterSharedInfrastructureDomains(tt.domains))
+		})
+	}
+}