fix: Origin allowlist with Sec-Fetch-Site, and verify the cookie's inner access token #15

Follow-up to the v0.20 JS adapter hardening (fells-code/seamless-auth-server#234, issues #230 and #231 there), which this adapter does not do yet.

• Origin check with Sec-Fetch-Site present (server#230). When the adopter configures allowed origins, a state-changing same-site request must carry an Origin in that list; a missing Origin is refused. same-origin always passes, cross-site is always refused, and nothing changes when no allowlist is configured.
• Verify the token inside the access cookie (server#231, defense in depth). When the adapter knows the auth server URL and audience, the guard verifies the API access token inside the signed cookie against JWKS, requires a matching sub, and takes roles from the verified token, instead of trusting the decoded claims. A forged cookie then cannot carry claims on its own, even if the cookie secret leaks.

Each item needs tests. Ships with the next adapter release.