iOS: restrict A2UI action dispatch to trusted canvas URLs (#58471)
* fix(ios): restrict a2ui bridge trust
* test(ios): cover fragment-strip trust and document raw-string equality
* fix(ios): normalize capability URL before trust comparison in canvas commands
* fix(ios): trim canvas.navigate url before trust comparison
* chore: add changelog for iOS A2UI trust boundary
---------
Co-authored-by: Devin Robison <drobison@nvidia.com>
