UNOMI-978: Gate cross-profile merge and systemProperties writes on a trusted caller

[sergehuber]

Two built-in actions operate on identity rather than on the calling profile's own data.
MergeProfilesOnPropertyAction merges the current profile into another one selected by a property
value, and UpdatePropertiesAction can write systemProperties, where trust-bearing state such as
merge and identity markers is kept. Deciding that two profiles are the same person, or writing the
markers that record it, is a claim about identity, and a claim about identity should come from a
caller the server has established as entitled to make it.

Both now require a trusted caller, behind a single isTrustedIdentityCaller() seam. Writes to a
caller's own properties and same-profile merges are unchanged, and a server-side integration
holding the tenant private key keeps both capabilities.

A refused attempt is logged through the shared org.apache.unomi.api.utils.LogSanitizer, so a
request-derived value cannot break out of its log record.

The login sample is rewritten to demonstrate the pattern this leaves in place: the browser posts to
the operator's own servlet, which holds the tenant private key and performs the merge server-side,
rather than asking the visitor's browser to assert who it is. Integrations that performed the merge
from the browser need to move that step behind their own server, which the sample now shows end to
end.

Jira: https://issues.apache.org/jira/browse/UNOMI-978