instconf: one reading of the instance config origins

Five services and this library each grew a copy of the same three lines
that turn config.ini into an origin, and the copies drifted. Two donors
canonicalized with TrimRight and TrimSuffix respectively, so a config
carrying "https://x//" produced two different strings in two daemons
that must produce the same one when comparing against an Origin header.
One repo held two origin-to-host extractors that disagreed about a
malformed origin: one returned an error, the other answered "localhost".
A third copy feeds the DNS-rebinding guard of an MCP endpoint, where an
empty host disables the guard.

CanonicalOrigin takes the strict reading (TrimSpace, then every trailing
slash). ExternalOrigin and InternalOrigin are two names rather than one
GetOrigin with a bool, because a flipped flag is invisible until a
browser is redirected to an address only the daemon can reach.
OriginHost returns a host name and OriginAuthority a host[:port], the
two things the disagreeing donors each needed, and neither invents a
host for an origin that names none. InternalAPIOrigin walks the four-key
ladder and reports absence as a bool instead of core-go's panic, and
Require reports every missing key in one error so an operator fixes the
config in one pass rather than one restart per key.