feat: allow adding trusted domains in instance setup (#11169)

# Which Problems Are Solved

When running Zitadel behind a reverse proxy and especially when the API
and the login UI don't run on the same domain, Zitadel needs to be
configured to trust the corresponding domains and use them in public
responses, like email links and more.
This can be done by adding a trusted domain. However it's currently only
possible through the API and not in the instance setup process.

# How the Problems Are Solved

Added a possibility to configure multiple trusted domains in the first
instance setup process.

# Additional Changes

None

# Additional Context

- closes #11153

cmd/setup/03.go

@@ -28,6 +28,7 @@ type FirstInstance struct {
 	PatPath            string
 	LoginClientPatPath string
 	Features           *command.InstanceFeatures
+	TrustedDomains     []string
 
 	Skip bool
 
@@ -102,6 +103,7 @@ func (mig *FirstInstance) Execute(ctx context.Context, _ eventstore.Event) error
 
 	mig.instanceSetup.InstanceName = mig.InstanceName
 	mig.instanceSetup.CustomDomain = mig.externalDomain
+	mig.instanceSetup.TrustedDomains = mig.TrustedDomains
 	mig.instanceSetup.DefaultLanguage = mig.DefaultLanguage
 	mig.instanceSetup.Org = mig.Org
 	// check if username is email style or else append @<orgname>.<custom-domain>

cmd/setup/steps.yaml

@@ -121,6 +121,11 @@ FirstInstance:
   PatPath: # ZITADEL_FIRSTINSTANCE_PATPATH
   LoginClientPatPath: # ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH
   InstanceName: ZITADEL # ZITADEL_FIRSTINSTANCE_INSTANCENAME
+  # A list of trusted domains, which are allowed to be used for public responses like email links or when running
+  # ZITADEL or the login UI behind a reverse proxy. If no trusted domain is set, the instance domain is used.
+  TrustedDomains: # ZITADEL_FIRSTINSTANCE_TRUSTEDDOMAINS
+  #  - login.example.com
+  #  - api.example.com
   DefaultLanguage: en # ZITADEL_FIRSTINSTANCE_DEFAULTLANGUAGE
   Org:
     Name: ZITADEL # ZITADEL_FIRSTINSTANCE_ORG_NAME