[PM-32249] Allow custom desktop protocol in CORS

[dani-garcia]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32249
https://bitwarden.atlassian.net/browse/VULN-411

📔 Objective

The desktop application is currently loading files using the privileged file:// scheme. If the application has an XSS vulnerability, the attacker could use this to read arbitrary files on the user's machine. To solve this, we have to define a custom scheme and a scheme handler for it, which gives us control over what files are and aren't accessible. The problem is that one of those privileges that we lose is the ability to ignore CORS, so now server has to specifically allow CORS from the custom scheme origin for the desktop app to be able to make requests.

This PR allows server to correctly accept CORS requests from the custom desktop scheme. Once versions of the server without this change are out of support, we'll be able to update the clients to use the new scheme.

POC on clients using a custom scheme: bitwarden/clients#19208
Some more info on electron's page: https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols

📸 Screenshots

[github-actions]

Checkmarx One – Scan Summary & Details – 374b07c0-e92a-48b8-8063-01c7d3b28665

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.67%. Comparing base (0de7c80) to head (a744fa7).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Core/Utilities/CoreHelpers.cs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7080      +/-   ##
==========================================
- Coverage   56.67%   56.67%   -0.01%     
==========================================
  Files        2024     2024              
  Lines       88635    88637       +2     
  Branches     7905     7905              
==========================================
  Hits        50238    50238              
- Misses      36571    36573       +2     
  Partials     1826     1826              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud