Wire Origin validation into the vMCP middleware chain

[JAORMX]

Follow-up from #4908 (Origin header validation for DNS-rebind protection)

#4908 wires the origin validation middleware into the thv run / thv proxy / proxyrunner paths. vMCP composes its own middleware chain (via factory.NewIncomingAuthMiddleware and pkg/vmcp/server/server.go's Handler) and does not reference the origin package, so vMCP-fronted servers do not currently enforce Origin-header validation.

Scope

• Integrate origin validation (or the shared origin.ResolveAllowedOrigins derivation) into the vMCP incoming middleware chain.
• Decide how the allowlist is configured for vMCP (CLI flag / config file / CRD), consistent with the workload-CRD follow-up.

Context

• Middleware + CLI/proxyrunner wiring landed in Add Origin header validation for DNS-rebind protection #4908; the original "vMCP wired" claim was corrected there.
• Relates to the MCP 2025-11-25 §"Security Warning" spec-compliance work.