fix(dashboard): trust configured public URL for websocket origin

[petrakersten]

Summary

• accept a configured dashboard.public_url / HERMES_DASHBOARD_PUBLIC_URL as a trusted WebSocket Origin when the dashboard itself is loopback-bound behind a reverse proxy
• preserve the existing DNS-rebinding guard for arbitrary Origins
• add a regression test covering the public-origin reverse-proxy case

Test Plan

• scripts/run_tests.sh tests/hermes_cli/test_web_server_host_header.py -q

[alt-glitch]

This was generated by AI during triage.

Related: competing OPEN fix PRs in the reverse-proxy dashboard WebSocket-origin cluster — #20615 (cloudflared), #42344 (trust configured public-URL host), #50380 (explicit WS-allowed-origins env). Canonical issue: #32615. These are different code deltas / trust-sources solving the same reverse-proxy WS-origin false-reject; a maintainer should pick one. Not marking any duplicate.

[petrakersten]

Closing this to avoid duplicating the existing public-dashboard-origin work in #42344 (and the broader #20615).

This PR was intentionally narrow, but #42344 now covers the same configured dashboard.public_url / trusted reverse-proxy host problem with a more complete Host/Origin test matrix. Keeping both open increases review load rather than improving the landing path.