fix: restore strict discovery URL validation with fixture allowlist

[FanouZeng-TT]

Change

test_discovery_urls in protocol_test.py has been permanently skipped
(@unittest.skip("Schemas not yet published...")) — the core UCP
schema/spec URLs for the declared 2026-04-08 version are now public and
the test itself runs cleanly once the blanket skip is removed. This PR
restores that conformance signal:

• removes the blanket skip and the now-unused import unittest
• validation is strict again for every URL not explicitly allow-listed
• a fixture-level allow_unreachable_urls list in
  test_data/flower_shop/conformance_input.json declares the seven
  external-party URLs the merchant discovery profile references but whose
  owners (Google Pay / Shop Pay / mock payment handler / REST OpenAPI)
  have not yet published for this version, so the suite stays green
  without weakening any other check
• each entry is a substring match; delete entries as each owning party
  publishes its URL (then that URL is strictly validated again)

Validation

• 2 files, +25/-2 (protocol_test.py,
  test_data/flower_shop/conformance_input.json)

• deterministic regression against the latest samples discovery profile:
  12 reachable URLs, none allow-listed; all 7 current 404s covered by the
  fixture list; an empty list restores failure on all 7 (non-listed URLs
  stay strict); simulated full run has 0 failures

• ruff check / ruff format clean, full pre-commit run --all-files
  green, git diff --check clean

• All validation and checks pass