Support configurable WebAuthn expected origins (native Android app support via android:apk-key-hash)

Native mobile apps calling WebAuthn/passkey APIs directly (not via browser) generate a non-HTTPS origin like `android:apk-key-hash:...`, which is spec-compliant but doesn't match any HTTPS URL. Since authentik currently only accepts its own request URL as a valid origin, it rejects all native in-app passkey authentication, so the code must be changed to accept a configurable set of additional trusted origins.

Add a configurable, multi-value "additional accepted origins" field (stage-level or provider-level) that gets merged with the existing request-derived HTTPS origin

Start by locating the existing request-derived origin validation and the stage/provider configuration definitions. Trace how origin settings are represented and merged, then inspect related authentication tests. Done means a multi-value additional-origins setting can be configured at the stated scope and native Android origins are accepted alongside the existing HTTPS origin.

Written by the indexing model from the issue text.