Expose one rule per source with rule-scoped options

Each registered Source now becomes its own CheckRule (name = source ID)
implementing CheckRuleWithOptions, so the host can toggle blacklists
individually and the per-source option fields show up under the rule
that owns them instead of one flat global option list.

Collect honours the host's per-rule enable map (via the SDK's
RuleEnabled context helper) and skips the network call for disabled
sources entirely, not just their evaluation.

checker/collect.go

@@ -38,6 +38,11 @@ func (p *blacklistProvider) Collect(ctx context.Context, opts sdk.CheckerOptions
 
 	var wg sync.WaitGroup
 	for i, s := range sources {
+		// The host disables a source by disabling its rule (rule name == source ID).
+		// Skip the network call entirely; Evaluate is short-circuited host-side.
+		if !sdk.RuleEnabled(ctx, s.ID()) {
+			continue
+		}
 		wg.Add(1)
 		go func(i int, s Source) {
 			defer wg.Done()