[FEATURE] Share backend login across domains

[Kanti]

Introduce a session transfer token to propagate the active backend session to requests on other domains. The middleware restores the session cookie from the token and redirects the request with the correct backend session.

This improves the editor experience by avoiding additional logins during cross-domain editing.

related: #19, #12

TODOs:

• add origin binding for SessionTransferToken (to only allow specific domains)
• add clientIp binding
• make SessionTransferToken single use
• strip token for the redirect in PersistenceMiddleware::setSessionCookie
• gracefully ignore expired handoff tokens instead of crashing
• check if cross-origin works even with BE[cookieSameSite]=strict

[Kanti]

I think the best way forward with this problem is to eliminate all cross-origin Problems in one go.
For that I will proceed with #22