Implement reverse-proxy forward-auth

Add a /forward-auth endpoint that validates the existing Porchlight
session for reverse proxies and returns identity headers for
authenticated active users. Unauthenticated or inactive sessions
redirect to login, with optional post-login return targets reconstructed
from proxy headers and constrained by an allowed host list.

Also add forward_auth_allowed_redirect_hosts configuration, preserve
validated forward-auth return targets through login/session reset,
exempt the endpoint from CSRF for proxy subrequests, document
configuration, and cover the flow with tests.

porchlight.dev.toml

@@ -11,6 +11,7 @@ issuer = "https://auth.example.com"
 # sqlite_path = "data/oidc_op.db"
 # signing_key_path = "data/keys"
 # invite_ttl = 86400
+# forward_auth_allowed_redirect_hosts = ["app.example.com", "*.apps.example.com"]
 
 # Register OIDC Relying Party clients below.
 # Each [clients.<client-id>] section defines one client.