Share one default-port normalisation helper between v2auth.match and isLocalHarbor

[bupd]

Follow-up from #873.

"A URL's default port is :80 for http and :443 for https, and two URLs that differ only in whether it is written out are the same URL" is now stated in two places:

• match() — src/server/middleware/v2auth/auth.go:141 — normalises downward, stripping the default port from the configured URL and from the request host before comparing.
• hostPort() — src/pkg/reg/adapter/harbor/base/adapter.go (added in fix(replication): Normalise CORE_URL comparison in isLocalHarbor #873) — normalises upward, writing the default port out on both sides before comparing.

The two agree today, and #873 carries a comment in each direction saying so. They are still two copies of the same port table, and the next one that needs it will be a third.

Worth extracting into one helper in src/lib. Deliberately not done in #873: that PR is a bugfix on the replication adapter, and folding it in would have put an auth-middleware change with no behavioural gain into its review surface.

Notes for whoever picks it up:

• The two call sites compare different shapes. isLocalHarbor compares two full URLs (scheme, host, port, path). match() compares a URL against a bare request host with no scheme of its own. Only the port normalisation is common — the helper should be about the port, not about URL equality.
• match() is case-sensitive on the host; isLocalHarbor uses strings.EqualFold. Hosts are case-insensitive, so aligning on the fold is the correction, but that is a behaviour change to an auth path and wants its own test pass.
• v2auth has existing table tests; they must stay green untouched.