Closing potential security issue: xcube server allows for host name forging

[thomasstorm]

This PR closes the security vulnerability documented in #1203, and in more detail in the mail "Potential Security Issue-Host Name Vulnerability in Xcube" to xcube-team@brockmann-consult.de on 2026-03-21.

To test, you can run a local server, and make a GET-request to http://localhost:8080/openapi.html, with the header field "Host" set to geodb.openeo.brockmann-consult.de (or any other host that serves an openapi.json). The server will redirect you to geodb.openeo.brockmann-consult.de/openapi.json, which poses a potential security threat.
The PR allows to add a whitelist for allowed hosts in the configuration:

allowed_hosts:
    - "localhost:8080"

Once set, GET requests to http://localhost:8080/openapi.html with 'Host' set to anything else than listed in the allowed_origin will result in an HTTP 400 error.

Checklist:

• Add unit tests and/or doctests in docstrings
• Add docstrings and API docs for any new/modified user-facing classes and functions - dna
• New/modified features documented in docs/source/* - dna
• Changes documented in CHANGES.md
• GitHub CI passes
• AppVeyor CI passes
• Test coverage remains or increases (target 100%)

Fixes #1203.

[forman]

Looks good overall, but please consider my suggestions and notes.

[forman]

...and please use a clear, findable PR title.

You can include Fixes #1203 in the description to autoclose #1203 on merge.

[forman]

...also note that the build is currently failing.

[konstntokas]

See my one comments. Otherwise it looks good. :)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.53%. Comparing base (d94ebe7) to head (84fec58).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1210   +/-   ##
=======================================
  Coverage   89.53%   89.53%           
=======================================
  Files         280      280           
  Lines       21655    21662    +7     
=======================================
+ Hits        19389    19396    +7     
  Misses       2266     2266           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.