fix(privacy): drop nvidia-bug-report / dmidecode false positives

- Allowlist nvidia.com, mellanox.com, gnu.org, debian.org, ubuntu.com; the
  common "not specified / not available" FRU placeholders.
- Reject matches with no alphanumeric or <2 chars (stray ":" from a dumped
  resolv line), fru_location values that echo the field name ("Base Board
  Asset Tag", "P1-DIMMA1_AssetTag"), IPv4 embedded in a version string
  ("18:6.1.4.5"), and e-mail on kernel ring-buffer lines (driver copyright).
- Customer guess: don't report a single-hit low-confidence domain at all -
  "unidentified" beats guessing nvidia.com from a driver comment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/privacy/allowlist.go

@@ -19,6 +19,7 @@ var (
 		"libssh.org", "rsyslog.com", "adiscon.com", "redhat.com", "kernel.org",
 		"megarac.com", "ami.com", "commond.com",
 		"oasis-open.org", "w3.org", "xmlsoap.org", "purl.org", "ietf.org",
+		"nvidia.com", "mellanox.com", "gnu.org", "debian.org", "ubuntu.com",
 		"inspur.com", "inspurcloud.com", "inservice-iq.com", "ieisystem.com", "kaytus.com",
 		"jd.com", "jd.local", "jdcloud.com", "in-addr.arpa", "ip6.arpa", "arpa",
 	}
@@ -35,6 +36,14 @@ var (
 		"null":                   {},
 		"0":                      {},
 		"0.0.0.0":                {},
+		"not specified":          {},
+		"not available":          {},
+		"not present":            {},
+		"unspecified":            {},
+		"no asset tag":           {},
+		"no asset information":   {},
+		"empty":                  {},
+		"[empty]":                {},
 	}
 
 	// Archive members that are vendor factory templates, not the active config.