Harden RegistryChecker IRR/Whois origin parsing

[DeepZone]

Motivation

• Make Registry origin extraction resilient to realistic RIPEstat/Whois/IRR payload shapes to avoid brittle parsing and crashes.
• Support a variety of shapes (lists, nested lists, objects with fields, irr_records) while keeping raw data visible and keeping the checker read-only.
• Ensure a conservative decision policy: no false CRITICALs when origin evidence is absent.

Description

• Replace the tight list-only parser in _extract_route_origins() with a defensive walker and small helpers: _walk_records(), _walk_node(), _looks_like_field_list(), _extract_fields_from_record(), and _normalize_origin() to traverse lists, nested lists and dict-based records.
• Support data.irr_records, data.records, nested structures, object records with fields, and inline string blobs like "origin: AS3333" extracted only when the same record also contains route/route6 evidence.
• Normalize origins to uppercase ASxxxx format and accept numeric-only values (e.g. "3333" → AS3333) when clearly present in an origin context.
• Preserve existing check() behavior: absent registry route origins produce WARNING, UNKNOWN remains for missing/error payloads, and CRITICAL is only returned when a route/route6-origin is found and contradicts the provided origin AS.

Testing

• Ran backend tests with cd backend && pytest -q and all tests passed (27 passed).
• Built frontend with cd frontend && npm run build and the production build completed successfully.

---

Codex Task