Improved: Add CORS origins configuration for API security policy (OFBIZ-13377)

[golja]

This PR is related to the issue raised by @gsperi on the dev-list on March 23, 2026 (subject: "rest-api plugin and CORS filter") regarding incorrect management of CORS origins in the rest-api plugin.

To address the issue, this PR:

• introduces the new property cors.origins.allowed in security.properties, allowing the list of permitted origins to be specified;
• adds the new method getCorsOriginsAllowed() to UtilMisc to retrieve the list of allowed origins from cors.origins.allowed.

[jacopoc]

It looks good to me.
@gsperi if you feel comfortable you can merge this pull request (and the one for ofbiz-plugins that depends on this).

[gsperi]

It looks good to me. @gsperi if you feel comfortable you can merge this pull request (and the one for ofbiz-plugins that depends on this).

@jacopoc do you usually "Squash and merge" or "Rebase and merge"?

[jacopoc]

@gsperi I usually prefer to "Rebase and merge" in order to preserve the original commits of the author, if they are clean and they follow our guidelines, as it is the case for these two pull requests.

[gsperi]

@gsperi I usually prefer to "Rebase and merge" in order to preserve the original commits of the author, if they are clean and they follow our guidelines, as it is the case for these two pull requests.

Ok, clear. I'll proceed with Rebase and Merge. Thank you Jacopo.