[identity] validate origins provided through env var

Summary:
quick follow up to ENG-6926. the HeaderValue::from_str function takes pretty much any ascii string, but we should validate these strings first to make sure we have the right format in terraform, where we set the value of ALLOW_ORIGIN_LIST

we already use the url crate in shared/backup_client and services/commtest

Test Plan: unit tests, tested that other schemes like ftp and missing ports don't work on staging

Reviewers: will, bartek

Reviewed By: bartek

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D11250