ref(toolbar): check allowed origins in iframe view

[aliu39]

Updates iframe view to lookup the project from the URL param, after auth. Handles missing project and allowed origins for the request (set up by a project setting).

Decided with @ryan953 we'll only allow wildcards in the project settings, for the leftmost subdomain only.

Closes #77214

[codecov]

Codecov Report

Attention: Patch coverage is 92.85714% with 4 lines in your changes missing coverage. Please review.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/sentry/toolbar/utils/url.py	91.30%	1 Missing and 1 partial ⚠️
src/sentry/toolbar/views/iframe_view.py	93.54%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #77756       +/-   ##
===========================================
+ Coverage   56.23%   78.10%   +21.87%     
===========================================
  Files        6974     6989       +15     
  Lines      309287   310110      +823     
  Branches    50629    50742      +113     
===========================================
+ Hits       173932   242222    +68290     
+ Misses     130937    61443    -69494     
- Partials     4418     6445     +2027     

[aliu39]

• Ready, but needs test coverage:

• unit tests for url_matches

• e2e tests making requests to iframe_view

  • project doesn't exist
  • missing REFERER
  • missing/unsupported scheme
  • calls mock url_matches

[cmanallen]

Finish the todos. Add test coverage.

[aliu39]

Do we have any need for this response header? https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors