scanmalware: report a rejected value as rejected, and look up a URL as that URL

[jonaslejon]

Follow-up to #803, which merged this morning. Three fixes, one of them a correctness
bug I found while chasing @adulau's review comment.

A URL attribute is now looked up as that URL. The merged module takes the newest
scan of the same host, so enriching https://github.io/ reports the verdict for
http://cobig99.github.io/microsoft365-en-us-excel/ as though it judged the attribute.
Measured against the live API just now:

	scan reported for https://github.io/
as merged	http://cobig99.github.io/microsoft365-en-us-excel/
with this change	https://github.io/

Host-level fallback is still there, because it is often what you want, but it now says
so: "has no scan of X; nearest scan on the same host: Y".

This was only fixable now. The API's url: filter used to terminate a field value at
the first :, so url:https://… silently matched every scan; querying the host was the
workaround. That was reported and fixed server-side on 2026-08-27.

A rejected value is reported as rejected. Following @adulau's note, the API now
returns 422 for a value that is not a hostname. The module turned that into "No
ScanMalware results for this attribute", which says we looked and found nothing when no
valid question was asked. A single-label MISP hostname attribute reaches this in
ordinary use:

hostname: localhost
  error: ScanMalware rejected this value: Invalid value for parameter
         path -> domain: must be a hostname with at least two labels
         (e.g. example.com) or an IP address

Scans matched via a redirect carry the API's new matched_on field, so a scan of
another site that redirects to the queried host is explicable instead of looking like
noise.

Proof: 15 tests pass (pytest tests/test_scanmalware.py), flake8 clean with the
project config. The three new tests were each run against a deliberately broken build
first: removing the 422 branch, querying the host instead of the URL, dropping the
distinct fallback label, and dropping matched_on each fail the test that covers them
and nothing else. All three paths were also exercised against the live API, not only
mocks.