chore(Headless): #3591826 Simplify headless app environment configuration

Bálint Klérirequested to merge
issue/canvas-3591826:3591826-headless-env into 1.x

Renames DRUPAL_BASE_URL to CANVAS_SITE_URL and removes DRAFT_ALLOWED_FRAME_ANCESTORS. The Canvas origin is now derived from signed draft-session data for CSP and postMessage validation.

Closes #3591826 (closed). Authored with an AI coding agent.

Merge request reports