fix(cors): replace reference equality with value equality in isAny and isAnyMethod

[fatekingsama]

Summary

Fixes #12626

Changes

Replace reference equality (==) with value equality in CorsFilter#isAny
and isAnyMethod.

When CORS configuration is loaded from application.yml, deserialization
creates new List instances that are never reference-equal to the sentinel
constants CorsOriginConfiguration.ANY and ANY_METHOD, causing wildcard
checks to silently return false.

Fix

• isAny: also returns true when the list contains a single element equal to
  CorsOriginConfiguration.ANY.getFirst()
• isAnyMethod: also returns true when the list is empty

[yawkat]

Please add a test

[fatekingsama]

This was caused by IntelliJ automatically optimizing imports. I've updated the configuration and replaced wildcard imports with explicit ones.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes CORS wildcard detection when configuration is deserialized from application.yml by avoiding reference-equality checks that fail after binding.

Changes:

• Update CorsFilter#isAny to use value equality for wildcard origin/header lists.
• Update CorsFilter#isAnyMethod to treat empty method lists as wildcard.
• Add a Netty CORS preflight test exercising wildcard headers configured via application properties.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
http-server/src/main/java/io/micronaut/http/server/cors/CorsFilter.java	Adjusts wildcard detection logic and simplifies static header imports.
http-server-netty/src/test/groovy/io/micronaut/http/server/netty/cors/CorsFilterSpec.groovy	Adds coverage for wildcard allowed-headers behavior when configured via application properties.

[Copilot]

This test asserts the preflight succeeds, but it doesn’t validate the core behavior under test: that wildcard allowed-headers actually allows the requested header. Please also assert Access-Control-Allow-Headers is present and either contains Content-Type (or returns *, depending on expected behavior), so regressions in header handling are caught.

Suggested change

	response.headers.contains(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)
	response.headers.contains(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)
	response.headers.contains(ACCESS_CONTROL_ALLOW_HEADERS)
	String allowHeaders = response.headers.get(ACCESS_CONTROL_ALLOW_HEADERS)
	allowHeaders == "*" || allowHeaders.split(",")*.trim().contains("Content-Type")

[fatekingsama]

Friendly ping 👋 @sdelamo @yawkat
Would appreciate another review when you have a chance. Thanks!