Issue 760: CORS headers

[bertrandkerres]

Summary

This PR addresses issue #760 to allow calling BOPTEST from a web browser.
It adds CORS support to the web service.

CORS is configured conservatively: only origins matching localhost:<port> or
*.boptest.net are allowed by default. Additional origins can be whitelisted at
deploy time via the BOPTEST_ALLOWED_ORIGINS environment variable (comma-separated),
which is threaded through docker-compose.yml.

What's included

• New addCorsOriginHdr middleware that appends Access-Control-Allow-Origin and
  Vary: Origin to responses for allowed origins.
• New handleCorsPreflight middleware that responds to OPTIONS preflight requests,
  advertising the correct allowed methods, Content-Type and Authorization headers,
  and a 24-hour Max-Age cache.
• Full CORS coverage across all public API endpoints:
  • GET /version
  • GET /testcases
  • POST /testcases/*/select (all three variants)
  • GET /status/:testid, GET /name/:testid
  • PUT /stop/:testid, PUT /initialize/:testid
  • GET|PUT /scenario/:testid, GET|PUT /step/:testid
  • GET /measurements/:testid, GET /inputs/:testid
  • POST /advance/:testid, POST /submit/:testid
  • GET /kpi/:testid
  • PUT /results/:testid, PUT /forecast/:testid
  • GET /forecast_points/:testid
• OPTIONS preflight handlers for every non-simple request (POST, PUT, and any GET
  that may carry an Authorization header).
• Mixed GET+PUT routes (/scenario, /step) advertise both methods in their OPTIONS
  response so either verb works from a browser.

Tests

Unit tests (service/web/server/test/cors.test.js, mocha + supertest, no Docker needed):

• addCorsOriginHdr: header presence/absence, Vary header, env-var origin, next() always called
• handleCorsPreflight: 204 + full headers for allowed origins, 405 for disallowed/absent origin,
  correct Allow-Methods for GET / PUT / mixed routes, pass-through for non-OPTIONS verbs
• Origin allowlist: 8 allowed and 6 disallowed patterns (wrong scheme, no port, lookalike domains)

Run locally with:

cd service/web/server && npm install && npm test

Integration tests (service/test/test_testcase_api.py, runs against the deployed stack):

• GET /version and GET /testcases return Access-Control-Allow-Origin for an allowed origin
• OPTIONS /testcases returns 204 with all preflight headers including Max-Age: 86400
• OPTIONS /testcases/:id/select returns 204 and advertises POST
• Disallowed origin receives no CORS header

[bertrandkerres]

@dhblum Here is the PR for the CORS headers that we discussed in #820