stub out HPKE public key fetch for self-hosted authenticate (#4360)

Fetch the HPKE public key only when configured to use the hosted
authenticate service. Determine whether we are using the hosted
authenticate service by comparing the resolved authenticate domain with
a hard-coded list of hosted authenticate domains.

Extract this list of hosted authenticate domains to the internal/urlutil
package in order to keep a single source of truth for this data.

internal/urlutil/hostedauthenticate_test.go

@@ -0,0 +1,19 @@
+package urlutil
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsHostedAuthenticateDomain(t *testing.T) {
+	t.Parallel()
+
+	for _, domain := range HostedAuthenticateDomains {
+		assert.True(t, IsHostedAuthenticateDomain(domain), domain)
+	}
+
+	for _, domain := range []string{"authenticate.example.com", "foo.bar"} {
+		assert.False(t, IsHostedAuthenticateDomain(domain), domain)
+	}
+}