#26085)

fix(coderd/workspaceapps): verify workspace owner matches app username

When resolving a workspace app by workspace UUID, the URL's username
segment was never reconciled against the resolved workspace's owner.
A user could serve their own workspace app from a hostname embedding
another user's username, so the parsed origin username belonged to the
victim.  Combined with the username-equality CORS check, this allowed
credentialed cross-origin reads of the victim's app responses.

Reject the request with a 404 when the resolved workspace's owner does
not match the user named in the request.

Refs: https://linear.app/codercom/issue/PLAT-260
(cherry picked from commit 0b99e67)