Security hints: Google Web Risk / Safe Browsing provider

[mortenn]

Part of #285, #249, and meta #245.

Provider

Google Safe Browsing / Google Web Risk.

Fit

Useful broad URL threat intelligence, but not a good bundled default. Safe Browsing API is for non-commercial use only. Commercial or revenue-generating use should use Google Web Risk instead.

Data Sent

Lookup-style checks may send the full URL to Google. Hash-prefix/update-style flows can reduce disclosure but add complexity and pricing/implementation tradeoffs. The UI must disclose exactly which mode is used.

API / Terms Notes

Safe Browsing requires an API key and is non-commercial only. Google Web Risk requires Google Cloud setup and has a free tier for Lookup API calls, with paid usage beyond that. This should be a bring-your-own Google configuration.

Acceptance Notes

• Disabled by default.
• User-triggered only unless a future automatic-check setting explicitly enables reputation checks.
• Do not bundle an API key.
• Settings must distinguish Safe Browsing vs Web Risk if both are supported.
• Show provider-specific disclosure before sending full URLs or hash prefixes.
• Respect provider cache durations, quotas, and 429/5xx responses.
• Do not log URLs or API keys.
• Do not automatically call this provider when a URL matches Defaults.

Out of Scope

• Using Safe Browsing in a way that violates its non-commercial restriction.
• Implementing a local Safe Browsing update database unless explicitly chosen later.
• RDAP or public CT history lookups.