Introduce DomainResolver service, make DomainStorage a pure data layer

DomainStorage currently depends on RequestStack for hostname inference, scheme detection, and path prefix matching. Entity storage handlers should be pure data layers with no request coupling.

Changes

• New DomainResolver service owning all request-dependent and hostname-normalization logic: getRequestHostname(), getRequestScheme(), getRequestPath(), normalizeHostname(), loadByHttpHost(), isRegisteredHttpHost(), resolveDomain(), matchByPathPrefix(), matchPathPrefix(). Holds the RequestStack, domain.www_prefix, domain.allow_non_ascii, domain.path_prefix parameters.
• New Drupal\domain\Utility\MachineName::fromString() helper replaces DomainStorage::createMachineName() static.
• DomainStorage pure data layer: RequestStack, ignoreWwwPrefix, container properties become @deprecated; prepareHostname() / createHostname() / createMachineName() / getDefaultScheme() become deprecated wrappers delegating to domain.resolver or MachineName::fromString().
• Storage method names unchanged (loadByHostname() / loadMultipleByHostname()) — docblocks clarified that they expect normalized hostnames.
• Move matchPathPrefix() from Domain entity to DomainResolver, deprecating the entity method.
• DomainNegotiationContext gains DOMAIN_MATCHED_NONE/EXACT/ALIAS constants as the canonical home (the constants conceptually belong on the negotiation outcome holder, not on the negotiator service). The constants on DomainNegotiatorInterface become deprecated aliases referencing the new location — class-constant reference is fully transparent BC.
• DomainNegotiator thin orchestrator: negotiateActiveDomain() collapses to a single domainResolver->resolveDomain($context) call. Legacy entry points (setRequestDomain, setActiveDomain, negotiateActiveHostname, negotiateByPathPrefix, setHttpHost, getHttpHost, isRegisteredDomain) become deprecated wrappers with @trigger_error().
• Switch read-only consumers to DomainNegotiationContext: DomainCacheContext, DomainAccessManager, DomainAccessNodeHooks, DomainAccessEntityHooks, DomainConfigUiFormHooks, DomainSourceFormHooks drop the full DomainNegotiatorInterface dependency in favor of the lighter outcome holder. Reduces service-graph dependencies and circular-wiring risk. DomainAliasHooks drops its DomainNegotiatorInterface import entirely.
• Domain::preCreate() absorbs auto-fill logic (hostname / name / scheme / is_default) that used to live in DomainStorage::create().
• Consistent variable naming: $http_host for raw HTTP hostnames, $hostname for normalized (www-stripped).
• Deprecation cycle: deprecated in domain:3.1.0, removed in domain:4.0.0.

Bug fixes in passing

• $_SERVER['https'] (lowercase, never set by anything) becomes $_SERVER['HTTPS'] in the request-scheme detection path.
• is_default default for the first domain flips from (int)($default === FALSE) (always 0 because loadDefaultId() returns NULL, not FALSE) to (int) is_null($default) (correct: 1 when no default exists yet).

Test coverage

New DomainResolverTest kernel test covers each public method on DomainResolverInterface in isolation: getRequestHostname, getRequestScheme (http/https), getRequestPath (with and without an active request), normalizeHostname (www_prefix on/off), loadByHttpHost (known/unknown), isRegisteredHttpHost (known/unknown), resolveDomain (exact-match and default-fallback). 13 tests, 59 assertions. Closes the test-coverage gap for the resolver service. The integration paths (DomainHookTest, DomainPrefixTest, etc.) keep covering the full negotiator chain.

Updated callers

DomainNegotiator, DomainAliasHooks, DomainServerBlock, DomainPrefixPathProcessor, Domain entity, DomainForm, DomainRedirectResponse, Drush commands (domain + domain_alias), DomainAliasValidator, DomainAliasPatternConstraintValidator, six read-only consumers switched to DomainNegotiationContext, tests, docs.

Behavior changes

Strict superset for normal flows; deprecation warnings on legacy usage. Two notable changes:

1. DomainNegotiator::setRequestDomain($hostname, $reset) now ignores both arguments. Existing callers passing a specific hostname silently negotiate against the live request. The deprecation message explicitly calls this out and points at the migration path.
2. is_default default for the first domain is now correctly 1 instead of 0 (incidental bug fix).

Coordination

Rebased onto post-merge 3.x. Recent merges (#3588155, #3588168, #3588169, #3588175, #3588176) all touched the alias-side of the pipeline; this issue's domain-side resolver/negotiator refactor doesn't conflict with any of them.

Out of scope (separate issues)

• Removing the legacy deprecated wrappers on DomainNegotiator / DomainStorage and the deprecated constant aliases on DomainNegotiatorInterface. To be done in domain:4.0.0.
• Updating any external modules that still depend on DomainNegotiatorInterface for read-only access. They keep working through the deprecated path; they should migrate to DomainNegotiationContext at their convenience.

Supersedes #3583389.