ensure /__next middleware URLs are included in the origin check (#77416)
We have special development endpoints that are also prefixed under `/__nextjs`. This updates the origin checking logic to account for those in addition to `/_next`, and adds a test.