refactor(webui): converge the two loopback-origin helpers into one

> 🤖 Generated by the Agentic Engineer

## Why

Two pull requests fixed the same DNS-rebinding class in `pkg/webui/api` — #6255 (pod exec WebSocket upgrade) and #6251 (plugin install). Because they are on separate branches, each carries its own loopback-origin helper, deliberately named differently (`isLoopbackHost` and `isLoopbackOriginHost`) so the two branches cannot collide on merge with a duplicate definition.

Once both have landed the package will hold two near-identical helpers. That is a correctness risk rather than untidiness: a future change to what counts as a trusted origin could be applied to one and missed in the other, silently leaving one of the two endpoints on the weaker rule.

## What

After both PRs merge, collapse them into a single shared origin helper and have the exec upgrader and the plugin install guard call it. Behaviour-preserving; existing regression tests on both paths must pass unmodified.

Blocked until #6255 and #6251 are both merged.

Wait until #6255 and #6251 have merged, then inspect the two loopback-origin helpers in pkg/webui/api and the exec-upgrade and plugin-install call sites. Run the existing regression tests for both paths first; done means both call one shared helper, with behavior preserved and both tests passing unmodified.

Written by the indexing model from the issue text.