Fix/18552 cors wildcard credentials

[Bellambharath]

Summary

1. Treat * in AllowedOrigins as “any origin” when validating CORS policies.
2. Prevent persisting policies that combine AllowCredentials with *.

Testing

1. CORS Settings: AllowedOrigins = * + AllowCredentials = ON ⇒ warning shown, policy does not persist after refresh.
2. CORS Settings: AllowedOrigins = * + AllowCredentials = OFF ⇒ policy persists after refresh.

Fixes #18552

[hishamco]

Could you please share a GIF screenshot, before I test it myself

[gvkries]

If I understand this PR correctly, the same check done by the editor UI is now also done by the CorsOptionsConfiguration. Seems reasonable, please confirm this @hishamco

[Bellambharath]

Could you please share a GIF screenshot, before I test it myself
Here’s the GIF showing both flows:

1. Policy “Invalid config test” (AllowedOrigins="*", AllowCredentials=ON) shows warning and disappears after refresh.
2. Policy “Valid config test” (AllowedOrigins="*", AllowCredentials=OFF) persists after refresh.
   
   

[hishamco]

If I understand this PR correctly, the same check done by the editor UI is now also done by the CorsOptionsConfiguration. Seems reasonable, please confirm this @hishamco

That's what I understand, but I will check the PR