fix(framework): improve themeRoot validation

[nnaydenow]

Fix themeRoot validation to require explicit origin allowlist via meta tag and separate configuration storage from validated URL usage.

Problem:

• themeRoot URLs were not properly validated for security
• getThemeRoot() mixed raw configuration with validated URLs
• Missing validation for relative paths and URL formats

Solution:

1. Require meta tag for all themeRoot usage:

   • Comma-separated list of allowed origins
   • Wildcard "*" to allow any origin
   • Legacy "sap-allowedThemeOrigins" (camelCase) supported
   • Same-origin URLs allowed when meta tag present

2. Separate configuration from validation:

   • getThemeRoot() returns raw configured value (unchanged)
   • validateThemeRoot() performs security checks and normalization
   • DOM link creation uses validated URL: {validatedRoot}/UI5/Base/baseLib/{theme}/css_variables.css

3. Enhanced validation:

   • Absolute URLs: check origin against allowlist
   • Relative paths (./path, ../path): resolve to current origin
   • Absolute paths (/path): resolve to current origin
   • Add trailing slash if missing
   • Append /UI5/ to create proper theme asset path
   • Return undefined for invalid/unauthorized URLs

4. Proper error handling:

   • Log warning when validation fails
   • No DOM link created for invalid themeRoot
   • Graceful fallback to default theme behavior