fix: distinguish urllib parsing from network access

[sholmes222]

Why

LP1 treated any urllib reference as network access. That incorrectly required a network permission for local URL parsing through urllib.parse.

What changed

• Detect urllib.request, including from urllib import request, as network-capable.
• Exclude urllib.parse, which only parses local strings.
• Add regression coverage for URL parsing and both supported request import forms.

Verification

• Focused LP1 tests cover the false positive and both request import forms.
• DCO is present on the signed commit.
• CI is running for the current head.

[sholmes222]

Self-review update for 74a3561:

• The original narrowing correctly excluded urllib.parse, but missed from urllib import request.
• The matcher now covers both urllib.request and the request alias import.
• Regression coverage verifies that URL parsing does not trigger LP1 while both network-capable import forms do.

CI is running for the updated head.