fix(server): restrict CORS to VS Code webviews

[karakanb]

Motivation

• A previously-added global wildcard CORS policy exposed unauthenticated, sensitive endpoints (including POST /api/v1/query) to arbitrary browser origins, enabling cross-origin data exfiltration.
• The intent is to allow the Bruin VS Code extension's webview to call the local server while preventing arbitrary websites from reading local API responses.

Description

• Replace unconditional Access-Control-Allow-Origin: * middleware with origin validation that permits same-origin and non-browser clients and only allows validated vscode-webview:// origins, reflecting the exact origin and adding Vary: Origin (changes in pkg/server/server.go).
• Add helper functions sameOrigin and isVSCodeWebviewOrigin to validate origins and return HTTP 403 for disallowed cross-origin requests, and respond to authorized preflights with HTTP 204.
• Remove the wildcard CORS header from the SSE handler so the SSE stream cannot override the restricted policy (change in pkg/server/watcher.go).
• Add a regression test TestCORSMiddleware covering no-origin, same-origin, VS Code webview (including preflight), malicious website, and spoofed-scheme cases (change in pkg/server/server_test.go).
• Document the restricted cross-origin behavior in docs/commands/serve.md so users know the local API rejects arbitrary browser origins.

Testing

• Ran make test, which executed the Go unit test suite including the updated pkg/server tests and completed successfully.
• Ran make format where Go formatting and go vet passed, but frontend type checks could not be completed due to missing frontend dependencies in the environment.
• Attempting make deps failed to fetch modules from proxy.golang.org (HTTP 403 in this environment), so full dependency installation and a complete make build were not possible here.
• git diff --check and repository checks were run and reported no whitespace or diff-check issues for the changes.

---

Codex Task

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(server): restrict CORS to VS Code we..." | Re-trigger Greptile}