Add allowedOrigins to workload CRDs + operator wiring

Follow-up from #4908 (Origin header validation for DNS-rebind protection)

#4908 adds Origin-header validation to the CLI/proxyrunner path via the --allowed-origins flag and the origin middleware. The operator path is not yet covered: MCPServerSpec, MCPRemoteProxySpec, and VirtualMCPServerSpec have no allowedOrigins field, and operator-deployed pods bind to non-loopback addresses. As a result origin.ResolveAllowedOrigins returns nil and the middleware is skipped (with a WARN), so Kubernetes deployments currently ship with Origin validation disabled.

Scope

• Add an allowedOrigins []string field to the workload CRDs (MCPServer / MCPRemoteProxy / VirtualMCPServer).
• Serialize it into the generated RunConfig so the proxyrunner pod's middleware chain enforces it.
• Regenerate CRDs/docs and add controller tests.

Context

• Middleware + flag landed in #4908.
• Relates to the MCP 2025-11-25 §"Security Warning" spec-compliance work.

Start by locating MCPServerSpec, MCPRemoteProxySpec, and VirtualMCPServerSpec, then trace the existing allowed-origins flag and origin middleware from #4908 into RunConfig serialization. Inspect CRD and documentation generation plus the controller test setup. Done means all three workload CRDs expose allowedOrigins, generated configuration reaches the proxyrunner middleware, and controller tests cover the wiring.