[DDO-3763] Do CORS from Sherlock

[jack-r-warren]

Details in the ticket.

This does the CORS thing that we've been having the proxy do so far. Benefit now is that we can actually just pass the list of origins and it filters based on them, without treating them like a vulnerable regex like Apache does. Argument for this approach is that it's simpler.

We also move the CSRF mitigations from the proxy into Sherlock for the same reasons.

Two chart changes are required for this to work: we'll need to pass the origins into Sherlock's config and we'll need to configure the proxy to not mutate the Host/Origin headers so that this new middleware can see the real values.

Testing

Via unit test, my own manual testing, and most importantly, Sarah Gibson's testing from her pentest tools

Risk

Low

[github-actions]

No API changes detected

[github-actions]

Published image from 17343c8 (merge 9af7587):

us-central1-docker.pkg.dev/dsp-artifact-registry/sherlock/sherlock:v1.5.8-9af7587
us-central1-docker.pkg.dev/dsp-devops-super-prod/sherlock/sherlock:v1.5.8-9af7587

[codecov]

Codecov Report

Attention: Patch coverage is 91.66667% with 3 lines in your changes missing coverage. Please review.

Project coverage is 77.71%. Comparing base (b10f73d) to head (17343c8).
Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #590      +/-   ##
==========================================
+ Coverage   77.65%   77.71%   +0.05%     
==========================================
  Files         203      206       +3     
  Lines        9572     9610      +38     
==========================================
+ Hits         7433     7468      +35     
- Misses       1489     1491       +2     
- Partials      650      651       +1     

Files	Coverage Δ
sherlock/internal/boot/router.go	71.42% <100.00%> (+2.67%)	⬆️
.../internal/middleware/csrf_protection/middleware.go	100.00% <100.00%> (ø)
sherlock/internal/middleware/cors/middleware.go	72.72% <72.72%> (ø)

... and 1 file with indirect coverage changes

[mikeflinn]

Makes sense to me

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
21.6% Duplication on New Code

See analysis details on SonarCloud