Fix review comments on cookie banner API

Parse only the first IP from X-Forwarded-For to prevent
the full chain from bypassing anonymization. Add secondary
sort key for deterministic consent selection. Reject origins
with empty port suffix in the validator.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/validator/validator_format.go

@@ -160,7 +160,7 @@ func Origin() ValidatorFunc {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}
 
-		if parsedURL.Host == "" {
+		if parsedURL.Host == "" || parsedURL.Hostname() == "" {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}