Enforce acl:origin so a browser app cannot wield full authority

[tophcodes]

What

Enforce acl:origin in the decision point, so an authorization can be restricted to the web origins allowed to exercise it.

Why

Without it, every browser application the user visits while authenticated acts with that
user's full authority. The user grants access to themselves; the browser hands it to
whatever page is currently open. NSS and CSS both implement origin restriction for exactly
this reason, and it matters more here than for either of them, because this pod is
internet-facing and is becoming its own issuer (#57), so the app doing the asking and the
identity granting are about to live behind the same origin.

How

• wac::pdp::decide takes request context already; the Origin header joins it.
• An authorization naming one or more acl:origin values applies only when the request carries a matching Origin. An authorization naming none is unrestricted, as today.
• Decide what a same-origin request and a request with no Origin header mean: a non-browser client sends neither, and treating "absent" as "denied" breaks every script.
• Pin both directions in tests, the way fix(wac): a POST authorizes the container, not the child it allocates #80 pinned the POST rule: a matching origin passes, a non-matching one is refused, and the refusal is a denial rather than a 400.