fix(dev): use localhost port wildcard for default CORS/WebSocket origins

Replace the hardcoded :8080 default origins with the localhost
port-wildcard pattern (http://localhost:[*], http://127.0.0.1:[*]) so the
allowlist no longer assumes the server runs on 8080 (it may run on any
port, e.g. ng serve on 4200 or a user-set server.port).

Switch both origin sinks from setAllowedOrigins to setAllowedOriginPatterns
(AdkWebCorsConfig HTTP CORS and WebSocketConfig /run_live), since the [*]
port pattern is only honored by the *Patterns API; with setAllowedOrigins
it would be treated as a literal and match nothing.

Security posture is unchanged: any localhost port is allowed, while remote
origins, suffix tricks (evil.localhost.com) and non-http schemes remain
blocked.

Author: g0w6y

dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java

@@ -46,7 +46,7 @@ public class AdkWebCorsConfig {
   public CorsConfigurationSource corsConfigurationSource(AdkWebCorsProperties corsProperties) {
     CorsConfiguration configuration = new CorsConfiguration();
 
-    configuration.setAllowedOrigins(corsProperties.origins());
+    configuration.setAllowedOriginPatterns(corsProperties.origins());
     configuration.setAllowedMethods(corsProperties.methods());
     configuration.setAllowedHeaders(corsProperties.headers());
     configuration.setAllowCredentials(corsProperties.allowCredentials());

dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java

@@ -37,7 +37,7 @@ public record AdkWebCorsProperties(
     origins =
         origins != null && !origins.isEmpty()
             ? origins
-            : List.of("http://localhost:8080", "http://127.0.0.1:8080");
+            : List.of("http://localhost:[*]", "http://127.0.0.1:[*]");
     methods =
         methods != null && !methods.isEmpty()
             ? methods

dev/src/main/java/com/google/adk/web/websocket/WebSocketConfig.java

@@ -42,6 +42,6 @@ public WebSocketConfig(
   public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
     registry
         .addHandler(liveWebSocketHandler, "/run_live")
-        .setAllowedOrigins(corsProperties.origins().toArray(new String[0]));
+        .setAllowedOriginPatterns(corsProperties.origins().toArray(new String[0]));
   }
 }