fix(security): add configurable CORS origins via NC_ALLOWED_ORIGINS

[FaizanKolega]

• Introduces NC_ALLOWED_ORIGINS environment variable for CORS origin whitelisting
• Maintains backwards compatibility (defaults to permissive CORS)
• Enables credentials when specific origins are configured
• Updates all entry points to use centralized CORS configuration
• Addresses CWE-346 (Origin Validation Error)

Change Summary

Provide summary of changes with issue number if any.

Change Summary

Adds configurable CORS origin whitelisting via the NC_ALLOWED_ORIGINS environment variable to address unrestricted CORS configuration (CWE-346).

Current behavior: CORS allows all origins (*) by default across all entry points.

New behavior:

• If NC_ALLOWED_ORIGINS is not set: maintains current permissive behavior (backwards compatible)
• If set with specific origins: enables CORS whitelist with credentials support
• If set to *: explicitly allows all origins

This allows production/cloud deployments to restrict origins while maintaining flexibility for self-hosted users.

Change type

• feat: (new feature for the user, not a new feature for build script)
• fix: (bug fix for the user, not a fix to a build script)
• docs: (changes to the documentation)
• style: (formatting, missing semi colons, etc; no production code change)
• refactor: (refactoring production code, eg. renaming a variable)
• test: (adding missing tests, refactoring tests; no production code change)
• chore: (updating grunt tasks etc; no production code change)

Test/ Verification

Test 1: Default behavior (no env var)

# Start NocoDB without NC_ALLOWED_ORIGINS
npm start
# Verify CORS allows all origins
curl -H "Origin: https://example.com" http://localhost:8080/api/v1/health -v
# Should return Access-Control-Allow-Origin header

Test 2: Single origin whitelist

NC_ALLOWED_ORIGINS=https://app.example.com npm start
# Verify only whitelisted origin is allowed
curl -H "Origin: https://app.example.com" http://localhost:8080/api/v1/health -v
# Should return Access-Control-Allow-Origin: https://app.example.com
# Should also return Access-Control-Allow-Credentials: true

Test 3: Multiple origins

NC_ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com npm start
# Both origins should be allowed

Test 4: Exposed headers maintained
All configurations should continue to expose xc-db-response header.

Additional information / screenshots (optional)

Files modified:

• New utility: packages/nocodb/src/utils/nc-config/cors.ts - Centralizes CORS configuration logic
• Updated all entry points: main.ts, docker.ts, dockerEntry.ts, cloud.ts, local.ts, testDocker.ts
• Added constant: NC_ALLOWED_ORIGINS in constants.ts

Security considerations:

• Backwards compatible: no breaking changes for existing deployments
• Credentials enabled only when specific origins are configured (prevents wildcard + credentials)
• Follows existing NocoDB patterns for environment variable configuration

Usage examples:

# Single origin
NC_ALLOWED_ORIGINS=https://app.example.com

# Multiple origins (comma-separated)
NC_ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com

# Explicit wildcard
NC_ALLOWED_ORIGINS=*

# Not set (default - permissive)
# [no configuration needed]