Improved: Add CORS origins configuration for API security policy

[golja]

This PR is related to the issue raised by @gsperi on the dev-list on March 23, 2026 (subject: "rest-api plugin and CORS filter") regarding incorrect management of CORS origins in the rest-api plugin.

To address the issue, this PR:

• introduces the new property cors.origins.allowed in security.properties, allowing the list of permitted origins to be specified;
• adds the new method getCorsOriginsAllowed() to UtilMisc to retrieve the list of allowed origins from cors.origins.allowed.