Support host request option to override the session QR host

[rubenhensen]

Since irmago v0.14.0, a session request can include an optional `host` field that overrides the host used in the QR (`Qr.u`). The server validates it against the requestor's configured `host_perms` allowlist.

This is the cleanest way for a requestor running behind a reverse proxy or with multiple public hostnames to control which one ends up in the QR that the user's IRMA/Yivi app scans.

Proposed surface

Add an optional `host: Option` field to the base request that the disclosure/issuance/signature builders share, and a builder method (e.g. `.host("…")`) on each public builder.

References

• irmago v0.14.0 release

[dobby-coder]

/dobby fix — Add an optional host field to the irmars session request, mirroring irmago's host field (irmago v0.14.0) that overrides the host used in the QR (Qr.u) and is validated server-side against the requestor's host_perms allowlist. Expose it as host: Option<String> on the base request, serialize as host only when set, add a builder setter + a unit test. Run the test suite and open a PR that closes this issue.

[dobby-coder]

On it! I'm picking up the fix to add a host field to irmars session requests and will open a draft PR once the change is ready.

[dobby-coder]

PR #18 is ready for review! I ran the full compliance check (74 rules) and merged it with the code review findings — everything came back clean. The host field sits on BaseRequest with proper skip_serializing_if + default, all three builders expose a .host() setter via the private BaseRequestBuilder pattern, and the test covers omission/serialization/round-trip. All CI passes (Clippy, Rustfmt, Conventional Commits, Integration tests).

I've flipped it out of draft: #18 — it just needs a human approval to merge.