fix: allow CORS from loopback addresses by default

[sapphi-red]

Description

Allow CORS from the following origins by default for convenience.

• hosts with localhost, domains of .localhost
• hosts with 127.0.0.1
• hosts with ::1

Technically, other addresses in 127.0.0/8 are also loopback addresses and safe to be allowed. But I didn't include them as it's not popular and makes the regex complicated.

refs #19239

[timacdonald]

@sapphi-red, thoughts on supporting the popular *.test tld here as well?

• https://www.rfc-editor.org/rfc/rfc6761#section-6.2
• https://en.wikipedia.org/wiki/.test

[sapphi-red]

I guess we can add .test as that TLD is reserved. But let me check if there aren't known any attack vector.

[bluwy]

Maybe we can also show that you can use defaultAllowedOrigins here so users don't copy the regex as is

[sapphi-red]

I didn't expose defaultAllowedOrigins so it's not possible to import it.

[bluwy]

Ah didn't notice that. I think it'd be useful to expose it, but we can do that in a later PR.

[sapphi-red]

@timacdonald This PR has been released in 6.0.11, 5.4.14, 4.5.9. We didn't include *.test by default (#19250) as we aren't sure if

• everyone would consider *.test origins to be a trusted source
• that is not discouraged by the RFC

[timacdonald]

Appreciate your work and help here.

We will add *.test in the Laravel plugin as this is the defecto TLD for local development in much of the tooling in the PHP ecosystem and any DNS change would need to be an intentional one.