fix: restrict CORS to allowlisted origins when strict

[VaibhavAcharya]

- Summary

Part of splitting the Identity security hardening work into reviewable pieces. Stacked on the opt-in flag wiring (#451); depends on its Security.Strict flag.

GoTrue returns Access-Control-Allow-Origin: * with credentials allowed, so any origin can make credentialed requests. This reflects only allowlisted origins when Security.Strict is set; with the flag off, the response is byte-for-byte the historical wildcard default. Strict mode reflects origins in Security.AllowedCORSOrigins (case-insensitive), falling back to the SiteURL origin when the allowlist is empty. The CORS wrapper runs before the per-request middleware, so in multi-instance mode it resolves the instance config itself from the operator JWS signature, and skips that work entirely when no Origin header is present.

- Test plan

• go build ./... and go vet ./... pass.
• go test -run 'TestCORS_FlagOffPreservesWildcard|TestCORS_FlagOnRestrictsOrigin|TestOriginAllowed|TestSecurityConfigurationDefaults' ./api/... ./conf/... passes.
• The multi-instance CORS suite test needs MySQL (hack/mysqld.sh); run go test ./api/... against it.

- Description for the changelog

Restrict CORS to a per-instance origin allowlist on Identity instances that opt in to strict security.

Link EX-1883

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ec8a908a-c813-4bf4-b57f-b0e14785dcf2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch vaibhavacharya/ex-1883-identity-cors-allows-all-origins-with-credentials-gotrue-brk

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}