Allow same origin CORS requests without 3rd party origins being configured

[sberyozkin]

Fixes #30698.

Earlier, when CORSFilter was enabling wildcard * Origins out of the box, the same origin requests were allowed by simply configuring quarkus.http.cors=true, but there was a hidden cost related to *.

Now that the * is not enabled by default, the same origin requests are only allowed if the quarkus.http.cors.origins is configured. More specifically, the same origin requests are allowed without having to configure them only if quarkus.http.cors.origins contains 3rd party origins.

If it is just a single-origin case as i #30698 then one needs to configure a wildcard or same origin URLs - but it should not be necessary if we allow now the auto same origin checks with the configured non-matching origins.

For example, right now, if we have

quarkus.http.cors=true
quarkus.http.cors.origins=github.com

then the same origin request to http://localhost:8081 will be allowed.

But if we only have

quarkus.http.cors=true

then the same origin request to http://localhost:8081 will not be allowed, which I believe should be fixed.

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[gastaldi]

I marked it to backport to 2.16.x and 2.13 too