Add validation of query parameter for server requests

[clarasb]

Summary

This PR adds validation of allowed query parameters for requests to static routes and configures the /api/viewer route to reject unknown URL query parameters.
This prevents unrelated scanner requests such as ?rest_route=/wp/v2/users/ from being served as the Viewer index.html with 200 OK.

Testing

Run the server locally:

xcube --loglevel INFO serve -c examples\serve\demo\config.yml  

In other terminal run:

curl.exe http://localhost:8080/viewer/?rest_route=/wp/v2/users/ #Windows
curl http://localhost:8080/viewer/?rest_route=/wp/v2/users/ #Linux/macOS

Closes #1225.

Checklist:

• Add unit tests and/or doctests in docstrings
• Add docstrings and API docs for any new/modified user-facing classes and functions
• New/modified features documented in docs/source/*
• Changes documented in CHANGES.md
• GitHub CI passes
• Test coverage remains or increases (target 100%)

[codecov]

Codecov Report

❌ Patch coverage is 87.09677% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.60%. Comparing base (8b3dc66) to head (fa2983e).

Files with missing lines	Patch %	Lines
xcube/server/webservers/tornado.py	85.18%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1230      +/-   ##
==========================================
- Coverage   89.61%   89.60%   -0.01%     
==========================================
  Files         280      280              
  Lines       21694    21724      +30     
==========================================
+ Hits        19440    19466      +26     
- Misses       2254     2258       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[forman]

Looks good to me, but please consider my suggestions. We may have to discuss this further in more detail.

[forman]

Query parameters should be, afaik, not case-sensitive.

[forman]

So we only protect the routes that use this argument.

This is currently only /viewer. An routes of the form /viewer/.../...? What others routes like /datasets?
Suggestion: allowed_query_params can also be a bool. If True, it can have any query params (like it is now). if False, any query parameters are forbidden. The new default would False and we need to check, which other endpoints must be protected.