Bug: is_project_leader can return false positives due to substring matching

## Summary
`is_project_leader` can return false positives because it uses substring matching on `leaders_raw`.

## Affected code
- `backend/apps/owasp/api/internal/queries/project.py` (`is_project_leader`)

## Problem
Current logic:
- `Q(leaders_raw__icontains=github_user.login)`
- `Q(leaders_raw__icontains=(github_user.name or ""))`

This can match partial strings and misclassify users as project leaders.

## Reproduction
1. Have a project where `leaders_raw` contains a leader like `joann` (or a name containing another user's login/name as a substring).
2. Query `is_project_leader(login: "ann")`.
3. Result may be `true` even when `ann` is not an actual leader.

## Expected
`is_project_leader` should only return `true` for exact, normalized leader identity matches.

## Actual
Substring matching can produce false positives.

## Why this matters
This query is used for role classification and can incorrectly grant project-leader status in the app experience.

## Proposed fix
- Replace substring matching with exact-token matching against normalized leader identifiers.
- Prefer structured parsing of `leaders_raw` (or a normalized intermediate representation) before comparison.

## Acceptance criteria
- No false positives from substring overlap.
- Add regression tests for collisions (e.g., `ann` vs `joann`).
- Existing valid leader lookups continue to work.