fix: use trustedOrigins instead of checkOrigin in svelte.config.js

[Mysterio-17]

Summary

Replaces the broad checkOrigin: true CSRF setting with an explicit trustedOrigins allowlist in svelte.config.js.

Changes

• cornucopia.owasp.org/svelte.config.js: replaced checkOrigin: true with trustedOrigins: ["https://owaspcornucopia.org", "https://cornucopia.owasp.org"]

Closes #2602

[Copilot]

Pull request overview

Updates the SvelteKit CSRF configuration for the Cornucopia site to use an explicit origin allowlist instead of a broad origin check, aligning with the recommendation in issue #2602.

Changes:

• Replaced csrf.checkOrigin: true with csrf.trustedOrigins: [...] to explicitly allow requests from https://owaspcornucopia.org and https://cornucopia.owasp.org.

---

You can also share your feedback on Copilot code review. Take the survey.

[Mysterio-17]

Hello @sydseter , have a look at this, whenever you have time.