Fix gitcookies domain matching to correctly handle wildcard entries

Authentication silently failed for some hosts because the gitcookies
domain match was both too narrow and too broad. The original substring
check (`domain in line`) matched the domain string anywhere in the
cookie record, including the value field, while entries stored with the
standard wildcard prefix (a leading dot, e.g. `.gerrit.example.com`)
were skipped entirely.

Parse the cookie record first and match the extracted domain field
according to the gitcookies wildcard convention: an entry with a leading
dot matches both the bare domain and any subdomain, while an entry
without one requires an exact host match. This avoids the opposite error
of letting a non-wildcard entry such as `my-gerrit.com` match an
unrelated `sub.my-gerrit.com`.

Add unit tests covering wildcard subdomain and exact matches and
confirming non-wildcard entries do not match subdomains.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Change-Id: I746d2ba13e74071e5a8cc9119fa5ef8b6ae63d76