fix: restrict ADK Web cross-origin defaults

[lethanhsang188]

Summary

• Default ADK Web CORS origins to an empty list instead of allowing every origin.
• Apply configured CORS origins to the /run_live WebSocket endpoint instead of hard-coding wildcard origins.
• Add regression coverage for default-deny and explicit-origin behavior.

Tests

• ./mvnw -pl dev -Dtest=AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev -Dtest=AdkWebServerTest,AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev clean test

[hemasekhar-p]

Hi @lethanhsang188, thank you for your contribution! We appreciate you taking the time to submit this pull request. As per contribution policy, please ensure your PR consists of a single commit. Could you please change your commits accordingly?

[lethanhsang188]

Thanks for pointing this out. I rebased the branch onto the latest main and squashed the PR to a single commit (d67bd777).

Local verification:

• ./mvnw -pl dev -Dtest=AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev -Dtest=AdkWebServerTest,AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev clean test

All passed.

[hemasekhar-p]

@lethanhsang188, thank you for addressing the pre checks. Currently this PR is under review by our team, we will keep you posted if any additional information is required. thank you.

[damianmomotgoogle]

This was already (partially) addressed in #1222

• cors support was added for live endpoint
• warning log is printed if cors defaults to '*'
• default remains as '*' for backward compatibility - will change behavior in future release