[Performance] Optimize url_suspect for high URL volume messages

[Performance] Optimize url_suspect for high URL volume messages

Performance improvements for messages with many URLs:

1. O(1) TLD lookups: Convert builtin_suspicious list to hash set on init,
   eliminates O(n*m) iteration (500k+ checks for 100k URLs × 5 TLDs)

2. Use rspamd_text for URL checks: get_text(true) returns opaque rspamd_text
   without string copying, use text:find() for RTL detection

3. Use rspamd_ip API: parse_addr() + is_local() for IP checks instead of
   pattern matching

4. Add max_urls limit (10000) for DoS protection

These optimizations significantly reduce memory allocation and CPU usage.