Extracts complete URL candidates with original UTF-16 spans. Fetching enforces network policy separately.