fix(dev): keep '*' CORS default, drive WebSocket origins from config, warn on '*'

Per review, retain backwards compatibility instead of changing the default
origin allowlist:

- Revert the default origins back to "*" (no change vs HEAD).
- Derive the /run_live WebSocket allowed origins from adk.web.cors.origins
  instead of a hardcoded "*", so both HTTP CORS and the WebSocket can be
  locked down via the single property.
- Log a startup WARN when origins is "*", noting it is insecure (dev only)
  and pointing users to set adk.web.cors.origins.

Author: g0w6y

dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java

@@ -16,6 +16,8 @@
 
 package com.google.adk.web.config;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.cors.CorsConfiguration;
@@ -42,11 +44,21 @@
 @Configuration
 public class AdkWebCorsConfig {
 
+  private static final Logger logger = LoggerFactory.getLogger(AdkWebCorsConfig.class);
+
   @Bean
   public CorsConfigurationSource corsConfigurationSource(AdkWebCorsProperties corsProperties) {
+    if (corsProperties.origins().contains("*")) {
+      logger.warn(
+          "CORS is configured to allow all origins (\"*\"), which is insecure and intended for"
+              + " local development only. This also applies to the /run_live WebSocket endpoint."
+              + " Set 'adk.web.cors.origins' to an explicit allowlist to restrict which origins"
+              + " may call the server.");
+    }
+
     CorsConfiguration configuration = new CorsConfiguration();
 
-    configuration.setAllowedOriginPatterns(corsProperties.origins());
+    configuration.setAllowedOrigins(corsProperties.origins());
     configuration.setAllowedMethods(corsProperties.methods());
     configuration.setAllowedHeaders(corsProperties.headers());
     configuration.setAllowCredentials(corsProperties.allowCredentials());

dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java

@@ -34,10 +34,7 @@ public record AdkWebCorsProperties(
 
   public AdkWebCorsProperties {
     mapping = mapping != null ? mapping : "/**";
-    origins =
-        origins != null && !origins.isEmpty()
-            ? origins
-            : List.of("http://localhost:[*]", "http://127.0.0.1:[*]");
+    origins = origins != null && !origins.isEmpty() ? origins : List.of("*");
     methods =
         methods != null && !methods.isEmpty()
             ? methods

dev/src/main/java/com/google/adk/web/websocket/WebSocketConfig.java

@@ -42,6 +42,6 @@ public WebSocketConfig(
   public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
     registry
         .addHandler(liveWebSocketHandler, "/run_live")
-        .setAllowedOriginPatterns(corsProperties.origins().toArray(new String[0]));
+        .setAllowedOrigins(corsProperties.origins().toArray(new String[0]));
   }
 }