feat: run commands from the page, gated by trusted origins

[KoSHeroff]

What

A page rendered in the webview can now run a Minecraft command, executed as the player — exactly as if they typed it in chat. No privilege escalation.

Trust model

Commands are accepted only from the main frame of an origin the server declares trusted, via trustedCommandOrigins in config/webgui/server.json:

{ "trustedCommandOrigins": ["https://ui.myserver.example", "http://localhost:3000"] }

• The list is sent to the client on join and cleared on disconnect, so trust never carries across servers.
• Requests from any other origin (after a redirect, or from an <iframe>) are dropped.

Changes

• WebGUITrustedOrigins — client-side registry of trusted origins (normalization, session-scoped).
• WebviewTrustedOriginsS2CPayload — sent on join, received on client (all targets).
• trustedCommandOrigins in server.json.
• command channel in WebviewPageToClientBridge: main-frame + origin check → run as player (sendChatCommand / connection.sendCommand).
• Reset trusted origins on disconnect.
• Bump to 1.6.0.

Pairs with the @webgui/react PR adding runCommand / useRunCommand.

Verification

• Compiles on all targets: fabric 1.20.1/1.21.1/1.21.11, neoforge 1.21.1/1.21.11/26.1.2/26.2.
• Full jar build of the active target succeeds.