Harden common third party enricher edge cases

Reject oversized logo responses instead of silently truncating them,
which could persist corrupt image bytes as a valid logo.

Tighten ownership substring matching with a length-ratio guard so a
short label root no longer attributes unrelated domains to a vendor.

Render the worker confidence threshold when set to zero by testing
against nil, so an explicit "accept all" value is not dropped by Helm's
falsy-numeric truthiness.

Sanitize and bound per-agent error text before persisting it to the
enrichment metadata column to avoid leaking unbounded internal detail.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/thirdparty/common_third_party_logo.go

@@ -196,11 +196,15 @@ func downloadImage(
 		return nil, "", fmt.Errorf("logo response is not an image: %q", contentType)
 	}
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxLogoSize))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxLogoSize+1))
 	if err != nil {
 		return nil, "", fmt.Errorf("cannot read logo body: %w", err)
 	}
 
+	if len(body) > maxLogoSize {
+		return nil, "", fmt.Errorf("logo response exceeds max size %d bytes", maxLogoSize)
+	}
+
 	if len(body) == 0 {
 		return nil, "", fmt.Errorf("logo response is empty")
 	}