fix(auth): allow cross-origin resource_metadata urls (#1302)

* fix(auth): allow cross-origin resource_metadata urls

* fix(auth): reject https-to-http metadata downgrade

* fix(auth): keep same-origin resource_metadata pointers

Routing every resource_metadata URL through the metadata host check rejected a resource's own origin when it is a private address, such as https://10.0.0.1/mcp pointing at /custom/prm.json, and new_allowing_private_addresses couldn't override it. Same-origin pointers are accepted again, cross-origin pointers follow the manager's private-address policy on every path, including resolve_metadata_from_challenge, and rejected resource_metadata URLs log the reason.

Author: DaleSeo