fix(browser): honor forwarded websocket host

[taigrr]

Summary

• use X-Forwarded-Host when building the browser viewer websocket URL
• accept comma-separated forwarded headers by using the first proxy value
• guard the package-level websocket upgrader and stabilize websocket tests that were racing the server setup

Testing

• go test ./...
• go test -race ./...
• staticcheck ./...