Match cookie-database denylist on domain forms

The cookie-database aggregator backstop normalised the agent's
third-party name and looked it up against bare brand keys, but
normalizeAlnum folds the eTLD into the key (cookiedatabase.org ->
cookiedatabaseorg). Domain- and URL-form attributions therefore
slipped past the exact lookup, letting noisy aggregator names be
accepted instead of discarded.

Add uri.DomainLabel to reduce a host-like string to its primary
registrable label and check it alongside the normalised name, so
both brand ("Cookiepedia") and domain forms ("cookiedatabase.org",
"https://www.cookiepedia.co.uk/list") resolve to the same key.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/uri/uri_test.go

@@ -292,6 +292,37 @@ func TestExtractDomain(t *testing.T) {
 	}
 }
 
+func TestDomainLabel(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{"bare domain", "cookiedatabase.org", "cookiedatabase"},
+		{"domain with www", "www.cookiedatabase.org", "cookiedatabase"},
+		{"full url", "https://www.cookiedatabase.org/list", "cookiedatabase"},
+		{"url with query", "https://cookifi.com/?ref=x", "cookifi"},
+		{"host with port", "cookieserve.com:8443", "cookieserve"},
+		{"co.uk tld", "https://www.cookiepedia.co.uk/list", "cookiepedia"},
+		{"uppercase", "CookieDatabase.ORG", "cookiedatabase"},
+		{"surrounding spaces", "  cookifi.com  ", "cookifi"},
+		{"bare brand no suffix", "Cookiepedia", ""},
+		{"empty string", "", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(
+			tt.name,
+			func(t *testing.T) {
+				t.Parallel()
+				assert.Equal(t, tt.want, DomainLabel(tt.raw))
+			},
+		)
+	}
+}
+
 func TestFilterFirstPartyDomains(t *testing.T) {
 	t.Parallel()