Headless JSON preview: restrict PBE handshake to configured Studio origins

The headless JSON preview now supports a previewclient.studio-url-whitelist property listing the Studio origins (scheme://host[:port]) allowed to drive the Preview-Based-Editing handshake. Previously no whitelist was injected, so coremedia.preview.js accepted the handshake from any origin. Configure the property on the headless-server-preview with your Studio origin(s); if left empty, a startup warning is logged and any origin is still accepted (as before). Mirrors the existing CAE cae.preview.pbe.studio-url-whitelist setting.

(CMS-30821)