CVE-2026-82209: domain-scoped PSL domain cookie

When libpsl is enabled and a response host is itself a public suffix (e.g. `github.io`), a `Set-Cookie` header whose `Domain` attribute exactly equals that host is accepted by `psl_is_cookie_domain_acceptable()` but stored with `tailmatch = TRUE`. RFC 6265 §5.3 requires this exact-match case to …

if(!is_ip)
  co->tailmatch = TRUE;