feat: add address poisoning detection to PhishingController

[AugmentedMode]

Explanation

This PR adds address poisoning detection to @metamask/phishing-controller by:

• Introducing a findSimilarAddresses utility that compares a candidate address against known recipients using prefix/suffix matching heuristics
• Exposing a new PhishingController:checkAddressPoisoning messenger action that clients can call to check if a recipient address looks like a poisoning attempt
• Hydrating and maintaining a set of known recipient addresses from:
  • Confirmed transactions via TransactionController state
  • Address book entries via AddressBookController state
• Subscribing to state changes on both controllers to keep the known recipients set up to date
• Returning match metadata (prefix/suffix match lengths, poisoning score, diff indices) so consumers can make informed decisions about how to warn users

References

• Related to address poisoning attack vector (learn more)

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Adds new recipient-hydration logic driven by TransactionController/AddressBookController state changes plus a new messenger-exposed method, so bugs could impact performance or client warning behavior though no funds-moving logic is changed.

Overview
Adds address-poisoning detection to @metamask/phishing-controller by introducing findSimilarAddresses and a new messenger action/method PhishingController:checkAddressPoisoning that returns similarity metadata (prefix/suffix match lengths, score, diff indices).

PhishingController now depends on @metamask/address-book-controller, hydrates a set of known recipient addresses from confirmed transactions and address-book entries, and keeps it updated by subscribing to both controllers’ stateChange events (with patch-aware transaction updates and rebuild fallbacks).

Includes new unit tests for the address similarity utility and extensive controller tests covering hydration, incremental updates, and failure-path logging; also tightens API error-type checks in a few existing scan methods.

^{Reviewed by Cursor Bugbot for commit 306647c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[imblue-dabadee]

Is this rebuilding the known recipients by iterating through every confirmed transaction every time there's a patch? If yes, surely there's a more reasonable alternative -- I can see this being expensive for power users.

[AugmentedMode]

Good callout. I changed this to update transaction recipients incrementally from the relevant transaction patch instead of rebuilding from every confirmed transaction on each update. It also tracks recipients per transaction id with counts, so removals and duplicate recipients are handled correctly.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4df8176. Configure here.}