Validate incoming requests to DevTools server (#10082)
* Validate incoming requests to DevTools server
The DevTools server (`server_api.dart` now has a `_validateRequest` function that performs a variety of checks to prevent cross-site request forgery and DNS rebinding:
* Prevents external websites from triggering local operations through cross-origin `GET` requests. Requests to the DevTools server are now required to be `POST` or `OPTIONS`. Web browsers will allow cross-origin `GET` requests through `img` tags or the `fetch()` API. Malicious websites could call `api/notifyForVmServiceConnection` and connect to a remote VM service, which could lead to CSRF attacks where DTD authentication tokens are read through `/api/getDtdUri`.
* Prevents DNS rebinding attacks by validating that the `host` header is within an allowlist of loopback addresses (`localhost`, `127.0.0.1`, etc) and is not malformed to mitigate DNS rebinding.
* Rejects requests where the `Sec-Fetch-Site` header is set to `cross-site` unless the `Origin` header is a valid loopback address. Otherwise, only `same-origin`, `same-site`, or `none` are allowed.
* Add release note for DevTools server request validation
* Address review feedback on DevTools server validation
Enforce `X-DevTools-Request` on `POST` requests, require `http`/`https`
origins without a path or query, disallow `Sec-Fetch-Site: same-site`
when `Origin` is absent, and return an `Allow` header on `405`
responses. Also add `disableOriginCheck` and `allowedOrigins` parameters
to `ServerApi.handle` for SDK flag parity and update the server tests.
