Potential fix for https://github.com/KiidxAtlas/python-hover/security/code-scanning/17

In general, to fix this kind of issue you must avoid substring checks on URLs or hostnames and instead perform exact or well-scoped comparisons against a whitelist of allowed hosts (or domains). For the Python docs, the canonical host is docs.python.org, and we should only treat URLs from that exact host (optionally with the www. prefix) as “Python docs”.

Concretely, in extension/src/ui/hoverPanel.ts, within getDocHostLabel, we already normalize the hostname by stripping a leading www.. The best minimal fix is to replace host.includes('docs.python.org') with a strict equality check: if the normalized host is exactly 'docs.python.org', return 'Python docs'; otherwise return host unchanged. This preserves existing behavior for legitimate Python docs URLs (whether they use https://docs.python.org/... or https://www.docs.python.org/...) while preventing other domains that merely contain that substring from being mis-labeled. No new methods or imports are required; we only change the conditional logic around that one line.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.