Score QR code risk from destination type, redirect depth, brand match, tracking exposure, and user context