restrict Matomo URL settings to allowlist determined by network admin

[diosmosis]

Description

Fixes MWP-1123

Allowlist

• introduce an allowlist of subdomains that a network admin can customize. by default includes *.matomo.cloud and *.innocraft.cloud.
  • when a site administrator tries to save a disallowed URL/host in a setting, it is refused with an error message
  • network admins can name any host/URL
  • note: the WordPress site's URL is purposefully not added to the default list, since a site admin could point a URL to a file they uploaded
  • a new wp-piwik_allowed_tracker_hosts filter can change the list from code

What site admins can no longer do

• change the Matomo URL, InnoCraft/Matomo cloud subdomain, CDN URL or CDN URL (SSL) to a host that isn't allowed. The old value is kept and an error names the rejected host and what is actually allowed.
• switch the connection method to one whose Matomo host isn't allowed
• values that aren't changing are never re-checked, so existing configurations can still be saved.

Disabling the Matomo connection

• setting the connection method to "disabled" is always allowed. if the stored Matomo URL points at a host that isn't allowed, the URL is removed so the connection can't be quietly turned back on

Stricter validation (applies to everyone)

• stricter validations added for cloud subdomains and URLs to prevent bypassing the allowlist

Review notice for existing networks

• the one time review notice for manual tracking mode/code now has a second list: the sites whose Matomo URL, CDN URLs or cloud subdomain point to a host that isn't allowed.
• sites that are not tracking are included, since a malicious value can end up being used if tracking is turned on later.
• dismissing the notice is permanent. sites that already use a host that isn't allowed keep it and are not reported again.

Other

• the proxy script loads the new allowlist class, so proxy tracking keeps working.

Checklist

• [✔/✖/NA] I have understood, reviewed, and tested all AI outputs before use
• [✔/✖/NA] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated