Allow origin patterns in corsAccessList #3050

Problem

http.corsAccessList and operationsApi.network.corsAccessList match an exact origin or * (security/auth.ts:103-132). Take a frontend served from per-PR preview hosts (https://<slug>.app.example.com) that calls an API on another origin:

• It can be allowed only by listing every preview origin.
• * with sessions enabled sends Access-Control-Allow-Credentials: true to every origin.

Proposal

Accept a single-label wildcard entry such as https://*.app.example.com:

• The scheme and port must match exactly.
• The wildcard covers one label only.
• A matching origin is echoed back, as an exact entry is today.

Part of #3042.