This PR lifts the restriction on the alternative origins feature to only
allow canister id based subdomains of `ic0.app` and `icp0.io`.

The canister id resolution is now the same for the session authorization
flow as it is for verifiable credentials.

The following restriction is still in place: the alternative origins file
needs to be served from a canister accessible on the `icp0.io` domain.

Allowances are made for local development using `localhost`, `0.0.0.0`,
`127.0.0.1` and custom HTTP gateways.

This PR also adds a unit test suite for the derivation origin validation.