fix(framework): explicitly allow setting sap-ui-themeRoot

[vladitasev]

This change requires developers to explicitly opt-in for allowing data-sap-themeRoot to be configured by URL. Other methods (configuration script, calling setThemeRoot directly) are not affected.

BREAK ING CHANGE:

For security reasons, setting the themeRoot parameter via URL must be explicitly allowed by calling:

import { allowThemeRootUrl } from "@ui5/webcomponents-base/dist/config/ThemeRoot.js";
allowThemeRootUrl(true);

Unless this method is called with true, setting data-sap-themeRoot in the URL has no effect and will produce a console warning.