fix(authentication-oauth): allow any port on loopback OAuth origins - #3699

Summary

• Fixes local OAuth redirects after the 5.0.40 exact-origin security change (fix(oauth): Patch open redirect and origin validation #3653 / fix(authentication-oauth): Use actual URL origin comparison for origin check #3676), which rejected common setups where the frontend runs on a different port than the configured origin (e.g. http://localhost vs http://localhost:5173).
• For local machine hosts only (localhost, 127.0.0.1, ::1, 0.0.0.0), match on scheme + host and ignore port.
• On a successful match, redirect using the referer origin so the access token returns to the correct local port.
• Non-loopback hosts still require an exact WHATWG origin match (security fix preserved). Config entries are also normalized via URL (trailing slash / default port / path on the config string no longer break matching).
• Clearer NotAuthenticated errors: report the normalized referer origin, list configured origins, and hint about ports and loopback matching.

Closes #3684

Test plan

• npm test --workspace @feathersjs/authentication-oauth (34 passing)
• Loopback any-port allow for localhost, 127.0.0.1, ::1, 0.0.0.0
• Redirect uses referer port, not config port
• localhost ≠ 127.0.0.1
• Non-loopback still requires exact port
• Scheme must still match on loopback
• Rejection errors include configured origins and a port/loopback hint
• Existing open-redirect / prefix-bypass security tests still pass