Allow blocking cross-site dev-only websocket connections from privacy sensitive origins (#91479)
See:
https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36
and [16.1.7](https://github.com/vercel/next.js/releases/tag/v16.1.7)
Co-authored-by: Sebastian "Sebbie" Silbermann <sebastian.silbermann@vercel.com>