Fix incomplete URL substring sanitization in extract_pdf.py (CodeQL #12)

[Copilot]

"github.io" in url is trivially bypassed — http://evil.com/github.io passes the check. CodeQL flags this as py/incomplete-url-substring-sanitization.

Changes

• extract_pdf.py: Replace raw substring check with urlparse-based hostname validation
  • Import urlparse from urllib.parse
  • Extract hostname and verify it equals "github.io" or ends with ".github.io"

# Before (bypassable)
if "github.io" in url or is_project_line or ...:

# After (safe)
parsed_host = urlparse(url).hostname or ""
is_github_io = parsed_host == "github.io" or parsed_host.endswith(".github.io")
if is_github_io or is_project_line or ...: