fix: Harden query server file access (#13053)
## Why
The local query server should only expose repository-scoped file data to
trusted localhost requests. Binding to loopback is not enough when
browsers can reach localhost services.
## What
Restricts the query server to localhost Host headers, removes permissive
CORS, and canonicalizes GraphQL file paths before enforcing that
returned files stay inside the repository root. Also updates stale query
subsystem documentation.
## How
Verified with:
- `cargo test -p turborepo-query`
- `cargo check -p turborepo-query`
Manual checks confirmed localhost requests still work, non-local Host
headers are rejected, CORS no longer grants arbitrary origins, repo
files can be read, and outside paths are rejected.
