Only lint JavaScript belonging to the tested page

[marcusosterberg]

Part of a sweep across the HAR-consuming plugins; same problem class as Webperf-se/webperf_core#1557 / #1558, Webperf-se/plugin-pagenotfound#156, Webperf-se/plugin-css#159 and Webperf-se/plugin-html#130.

Problem

Concurrent browsertime runs on one host can race for the same Chrome DevTools port; the crossed CDP session records the other run's page navigation into this run's HAR, so the HAR can contain more than one page.

transform2SimplifiedData collected every JavaScript response body and every inline <script> from every HTML document in the whole HAR into the eslint set, so a crossed-in recording attributes the other website's JavaScript issues to the tested website.

Fix

New getFirstPageEntries(url, harData):

1. keeps only entries whose pageref belongs to the first page in the HAR's pages array;
2. verifies the first recorded request's hostname matches the tested URL's hostname (new URL(...) punycodes IDN hostnames on both sides) — on mismatch nothing is analyzed.

Cross-domain scripts loaded by the tested page are still linted (pageref groups by initiating page, not by domain). HARs without a pages array and entries without pageref behave exactly as before.

Validation

Synthetic crossed HAR: only the tested page's external and inline scripts are collected, foreign scripts excluded; origin mismatch yields an empty analysis; legacy HAR without pages unchanged; eslint clean.