feat: Selective Allow for cross-origin local navigation (#57)

[ACK-J]

Problem

Clicking a link from an internet page to a local address (e.g. http://localhost:8080) is treated as a port scan because webRequest reports the external page as originUrl. That breaks legitimate workflows (Proxmox consoles, VPN dashboards, local dev links in docs).

Closes #57. Supersedes #74 (new implementation on current main, not a rebase of that draft).

Solution

For main_frame navigations to literal local/private URLs, open a Selective Allow popup instead of silently blocking:

Button	Effect
Block	Stays blocked; clears in-flight prompt state
Allow Once	Session-only (Set, cleared on restart)
Always Allow	Persists { origin, destination } under cross_origin_allowlist

Saved pairs are manageable from the settings page.

Subresources (fetch / XHR / iframes) and DNS-rebinding style portscans remain on the silent block + badge path.

Review fixes vs #74

• Validate originalUrl is local and host matches destination before navigate/persist
• Reuse the cancelled tab via tabs.update (fallback to tabs.create)
• Dedupe in-flight popups per origin|destination
• Guard against unsafe page path traversal in openSelectiveAllowPopup
• Built on current requestFilter.js architecture (no conflict with main)
• Unit tests for validation, session state, and popup helper

Test plan

• npm test (641 passed)
• Manual: from an external page, click http://localhost:8080 → popup appears
• Allow Once → same tab navigates; second click in-session allowed
• Always Allow → pair appears in settings; survives restart
• Subresource to localhost still silently blocked