feat: allow adding trusted domains in instance setup (#11169)

# Which Problems Are Solved

When running Zitadel behind a reverse proxy and especially when the API
and the login UI don't run on the same domain, Zitadel needs to be
configured to trust the corresponding domains and use them in public
responses, like email links and more.
This can be done by adding a trusted domain. However it's currently only
possible through the API and not in the instance setup process.

# How the Problems Are Solved

Added a possibility to configure multiple trusted domains in the first
instance setup process.

# Additional Changes

None

# Additional Context

- closes #11153

internal/command/instance.go

@@ -40,6 +40,7 @@ type InstanceSetup struct {
 	zitadel          ZitadelConfig
 	InstanceName     string
 	CustomDomain     string
+	TrustedDomains   []string
 	DefaultLanguage  language.Tag
 	Org              InstanceOrgSetup
 	SecretGenerators *SecretGenerators
@@ -294,6 +295,7 @@ func setUpInstance(ctx context.Context, c *Commands, setup *InstanceSetup) (vali
 		return nil, nil, nil, nil, err
 	}
 	setupCustomDomain(c, &validations, instanceAgg, setup.CustomDomain)
+	setupTrustedDomains(c, &validations, instanceAgg, setup.TrustedDomains)
 
 	// optional setting if set
 	setupMessageTexts(&validations, setup.MessageTexts, instanceAgg)
@@ -511,6 +513,14 @@ func setupGeneratedDomain(ctx context.Context, commands *Commands, validations *
 	return nil
 }
 
+func setupTrustedDomains(commands *Commands, validations *[]preparation.Validation, instanceAgg *instance.Aggregate, trustedDomains []string) {
+	for _, trustedDomain := range trustedDomains {
+		*validations = append(*validations,
+			commands.setupTrustedDomain(instanceAgg, trustedDomain),
+		)
+	}
+}
+
 func setupMinimalInterfaces(commands *Commands, validations *[]preparation.Validation, instanceAgg *instance.Aggregate, orgAgg *org.Aggregate, projectOwner string, ids ZitadelConfig) {
 	projectAgg := project.NewAggregate(ids.projectID, orgAgg.ID)