fix: enforce domain boundary in YouTube URL hostname check

getYoutubVideoIDFromURL used strings.HasSuffix(hostname, "youtube.com")
with no leading dot, so any hostname that merely ends in that string
(e.g. notyoutube.com, totally-legit-youtube.com) was misidentified as a
YouTube URL and rewritten into a YouTube/Invidious embed iframe using an
attacker-controlled ?v= value as the video ID. Sibling code in
referer_override.go handles the same class of check correctly with a
leading dot (e.g. strings.HasSuffix(hostname, ".cdninstagram.com")) --
this function was the outlier.

Fixed by checking for an exact match on "youtube.com" or a suffix match
on ".youtube.com", mirroring referer_override.go's existing pattern.