feat(dev-server): support allowedHosts - #178

…lhost) (#144)

Add the `allowedHosts` knob the `@angular/build:dev-server` builder
exposes so projects fronted by a tunneling proxy (ngrok, Cloudflare
Tunnel, GitHub Codespaces) or running under a non-default local
hostname (`*.localhost`, `app.local`) don't get rejected by the dev
server's `Host:` header check.

* `packages/builder/schemas/dev-server.json`: add `allowedHosts: array`.
* `packages/builder/src/serve/options.ts`: forward the list as
  `--allowed-hosts host1,host2`, normalizing empty/whitespace entries
  and case-insensitively deduping.
* `crates/cli`: new `--allowed-hosts` flag on `ngc-rs serve` (value
  delimiter `,`) wired through `serve_cmd::run` to the dev server.
* `crates/dev-server`: new `AllowedHosts` resolver + filter in
  `handle_request`. Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`)
  are always allowed. The literal `"all"` disables the check entirely;
  `"auto"` (or an empty list, the default) additionally accepts the
  bound host. Anything else is an exact, case-insensitive hostname
  match with the `Host:`-header port stripped before comparison.
  Mismatches respond with a 403 whose body names the offending host
  and points at both the angular.json option and the CLI flag.

Bumps workspace version to 0.10.12.