WebUI: Allow cross-origin links to webroot

The CSRF check rejects `GET /` from a different origin with 401, which breaks plain hyperlinks to the WebUI from other sites. The webroot serves only the static index document, so exempting it from the Origin/Referer check has no effect on attack surface.

Closes #23782.
PR #24379.