fix(backend): harden cross-origin resource sharing controls and prevent wildcard credentials

[mertcano]

Description

This PR addresses a high-severity Cross-Origin Resource Sharing (CORS) misconfiguration within the deso workspace's backend API (backend repository)[cite: 42]. The previous middleware configuration accepted arbitrary, unvalidated origins for public routes, enabling an application-wide CORS bypass that placed credentialed browser requests at risk[cite: 42].

Key Changes

• Explicit Origin Validation (backend/routes/server.go):
  • Overhauled the isAllowedOrigin function to enforce strict syntax validation via url.Parse and bounded domain-only matching[cite: 42].
  • The middleware now explicitly rejects * wildcard origin responses when Access-Control-Allow-Credentials is set to true, adhering to browser security specifications[cite: 42].
• Headers Boundary (backend/routes/server.go):
  • Updated AddHeaders to emit Access-Control-Allow-Origin and credential headers only when the incoming request's Origin strictly matches the configured allowedOrigins allowlist[cite: 42].
  • Added the Vary: Origin header to instruct intermediaries to cache responses separately per origin[cite: 42].
  • Preserved multipart video/image upload handling without resorting to insecure wildcard header reflections[cite: 42].
• CORS Wildcard Defaults (backend/cmd/run.go):
  • Removed wildcard fallback defaults from the access-control-allow-origins configuration mapping[cite: 42].

Validation & Testing

• Regression Coverage (backend/routes/server_cors_test.go): Added explicit unit test coverage confirming that configured, unconfigured, malformed, and wildcard origins are properly handled and rejected when necessary[cite: 42].
• Reviewer Action Required: The localized Go toolchain was unavailable during the offline audit (go test ./routes blocked)[cite: 42]. A maintainer must run the native test suite locally to verify the new CORS middleware logic against running backend environments.