feat: allow multiple authorized host options for SIWE

[paolodamico]

SIWE apps may have multiple authorized domains. This allows handling the different options.

---

Note

Medium Risk
Touches SIWE host-authorization logic; incorrect matching could allow or block authentication for unintended domains. Scope is small but security-sensitive, so test coverage and edge cases (ports/schemes) matter.

Overview
SIWE message parsing now accepts multiple authorized URL options: SiweMessage::from_str_with_account takes authorized_urls: Vec<String> and selects an expected_authority by matching the querying_url host/port against any provided authorized URL, rejecting if none match.

Tests are updated to pass URL lists and add coverage for matching from a mixed list of authorized domains, and Cargo.lock is refreshed (notably rand and rustls-webpki version bumps).

^{Reviewed by Cursor Bugbot for commit d1aa14f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 902ea607ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d1aa14f. Configure here.}