fix: implement dynamic CORS headers based on request origins (Fixes #1049)

[zeroknowledge0x]

Summary

Replaces hardcoded Access-Control-Allow-Origin: * with dynamic origin validation in the well-known cache worker, ensuring CORS headers are only sent for explicitly allowed origins.

Changes

workers/well-known-cache/src/index.ts

• Add ALLOWED_ORIGINS to the Env interface
• Add parseAllowedOrigins() function to parse comma-separated env var
• Add getCorsHeaders() function that validates request origin against allowlist
• Only sets Access-Control-Allow-Origin for requests from allowed origins
• Adds Vary: Origin header for proper cache key differentiation
• Update errorResponse() to accept and pass through CORS headers
• Replace all CORS_HEADERS constant usage with dynamic corsHeaders

wrangler.toml

• Add ALLOWED_ORIGINS environment variable with placeholder domain

Security Improvements

• Before: Any origin could make cross-origin requests (wildcard *)
• After: Only explicitly listed origins receive CORS headers
• Prevents unauthorized cross-origin access to cached .well-known resources
• Vary: Origin ensures proper cache segregation per origin

Configuration

Set ALLOWED_ORIGINS in wrangler.toml or Cloudflare dashboard:

ALLOWED_ORIGINS = "https://app.yourdomain.com,https://admin.yourdomain.com"

Related Issues

Fixes #1049