Harden IRMA proxy request handling

[dobby-coder]

A private draft security advisory has been filed for a trust-boundary hardening issue in the Yivi/IRMA proxy layer. Details (root cause, impact, reproduction, and the suggested fix) are in the advisory (repo admins only) — this issue exists only to track the fix work.

Scope: src/routes/irma/[...path]/+server.ts and its allowlist. Keep the fix branch/PR generic (e.g. harden IRMA proxy request handling) until the advisory is published — do not restate the mechanism in public commits/PR titles.

Please implement the fix per the advisory's "Suggested fix" section, add tests, and open a draft PR.

[dobby-coder]

Task details redacted while the associated security advisory is embargoed. See the draft advisory (repo admins only) for scope and the suggested fix.