e2e: use explicit values for Access-Control-Allow-Origin

[galargh]

Currently, we use Access-Control-Allow-Origin: ["*"] in our E2E setup. As raised #1121 (comment), we could try to be more explicit with access control.

See #1121 (comment) for prior attempts description.

[lidel]

Sorry for naive question if this was discussed before, but why do we need these CORS headers at all?

Companion should work without asking user to set any special headers, and out e2e tests should validate that it works "out-of-the-box" with IPFS Desktop.

• For Chromium and MV3 we have safelisted extension origin fix: allow ipfs-companion browser extension to access RPC API kubo#8690
• For older Chromium and Firefox,where origin is unique per user, we have access to blocking webRequest API, so we lift CORS limitation here

Can we remove explicit values for Access-Control-Allow-Origin, so we test real world use of RPC port?