feat(ocm): gate remote webapp actions by protocol

[MahdiBaghbani]

This PR is part of the cs3org/OCM-STA#20 and cs3org/OCM-STA#48

Summary

• Show Open remotely with <appName> only for resources that carry a usable received webapp name (ocmWebApp.appName, non-blank after trim) while ocm.openRemotely is on. The stock storageId.startsWith(OCM_PROVIDER_ID) check is removed: an OCM storage id, a remote share type, or a URL shape doesn't prove the sender offered a webapp, so a WebDAV-only share no longer shows the action.
• Launch without putting the token in a URL. The handler opens a named about:blank window synchronously, so the popup blocker allows it, then posts file=<resource.id> to /sciencemesh/open-in-app (feat(ocm): add safe received webapp launch cs3org/reva#5850) and submits the returned access_token to app_url in a hidden form POST that targets that window.
• Close the window and show a fixed "Couldn't open remotely" on any failure (post error, non-http(s) app_url, empty token, submit throwing). The error object isn't logged. No new config key; action id and extension point are unchanged.
• Supersedes Feature: open webapp #260.
• Backend metadata: refactor(ocm): add graph webapp metadata carrier cs3org/reva#5852 and feat(ocm): expose received webapp metadata cs3org/reva#5853.

flowchart TD
    A["Open remotely with appName"] --> W["window.open about:blank, named ocm-remote-timestamp"]
    W -->|"null, popup blocked"| PW["popup warning, no request"]
    W -->|"window"| P["POST /sciencemesh/open-in-app, file = resource.id"]
    P -->|"error"| E["close window, Couldn't open remotely"]
    P -->|"ok"| V{"app_url is http(s) and access_token non-empty?"}
    V -->|"no"| E
    V -->|"yes"| F["hidden form POST of access_token to app_url, target = that window"]

Loading

End to end, this launch only works when the Reva side can reach the sender. In the OCM Test Suite the providers sit on a private Docker network behind a MITM proxy, and Reva's launch client refuses private addresses until the hardening set (cs3org/reva#5833 to cs3org/reva#5839) is in master and the launch is wired to its allowed_federation_cidrs. So these specs cover the web side, and the full testbed run waits on that.

web-app-ocm gets @ownclouders/web-test-helpers as a dev dependency for the new specs, which is the only reason pnpm-lock.yaml changes.