[proxy] Enable CORS for api.<domain> from https://<domain> origin

[easyCZ]

Description

Extends our CORS plugin configuration to specify AllowedOrigins. This is done because the BaseDomain subdirective does not work (see #13740 for why), and in this case because we're enabling the cors for the sub-domain (api.) but allowing traffic from the root domain, we cannot use the BaseDomain directive anyway.

Related Issue(s)

• Part of Epic: Dashboard communicates with Public API #13574

How to test

Test we get the expected Access-Control-Allow-* headers when Origin is GITPOD_DOMAIN

 curl https://api.mp-proxy-c2a55ca9ff1.preview.gitpod-dev.com/ \
   -H "Origin: https://mp-proxy-c2a55ca9ff1.preview.gitpod-dev.com" \
   -H "Access-Control-Request-Method: POST" \
   -H "Access-Control-Request-Headers: X-Requested-With" \
   -X OPTIONS -i

HTTP/2 204
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
access-control-allow-methods: POST
access-control-allow-origin: https://mp-proxy-c2a55ca9ff1.preview.gitpod-dev.com
access-control-max-age: 60
server: Caddy
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
date: Wed, 12 Oct 2022 20:53:59 GMT

Test that no CORS are present when Origin does not match

curl https://api.mp-proxy-c2a55ca9ff1.preview.gitpod-dev.com/ \
   -H "Origin: https://random.website.com" \
   -H "Access-Control-Request-Method: POST" \
   -H "Access-Control-Request-Headers: X-Requested-With" \
   -X OPTIONS -i

HTTP/2 204
server: Caddy
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
date: Wed, 12 Oct 2022 20:55:13 GMT

Release Notes

NONE

Documentation

Werft options:

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-integration-tests=all
  Valid options are all, workspace, webapp, ide

[werft-gitpod-dev-com]

started the job as gitpod-build-mp-proxy-cors-allowed-origins-config.1 because the annotations in the pull request description changed
(with .werft/ from main)

[geropl]

Trying to come up with a negative test (waiting for preview env)...

[easyCZ]

Negative is here:

Test that no CORS are present when Origin does not match

curl https://api.mp-proxy-c2a55ca9ff1.preview.gitpod-dev.com/ \
   -H "Origin: https://random.website.com/" \
   -H "Access-Control-Request-Method: POST" \
   -H "Access-Control-Request-Headers: X-Requested-With" \
   -X OPTIONS -i

HTTP/2 204
server: Caddy
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
date: Wed, 12 Oct 2022 20:55:13 GMT

[geropl]

Code LGTM, tested and works ☑️

[geropl]

Negative is here:

Jep that one worked, was looking for testing with a previous commit, without any of these changes. but worked as well. 👍