Implement API message allowlist when proxying websocket messages

We should only allow some of the websocket messages that a client might send. We don't want clients to be able to modify the state of the musikcubed server, such as adding / removing playlists etc. This should be a setting in the config, since people might want to use it with musikcube still.