Add context-aware CORS policy to enhance security

[g2vinay]

Add context-aware CORS policy for HTTP transport mode

• Development mode (unauthenticated): Restricts to localhost origins only to prevent CSRF attacks

  • Allows localhost/127.0.0.1/[::1] with any port (supports MCP Inspector, custom ports)
  • Protects against cross-site request forgery when --dangerously-disable-http-incoming-auth is used
  • Prevents malicious websites from accessing developer's Azure credentials via localhost endpoints

• Production mode (authenticated): Allows all origins safely

  • JWT Bearer authentication validates all requests regardless of origin
  • Required for MCP clients (GitHub Copilot in VS Code/Codespaces) from various origins
  • CORS is a browser mechanism; authenticated API doesn't need origin restrictions

Replaces permissive 'AllowAll' policy with context-aware 'McpCorsPolicy'
Implements ConfigureCors() method shared by both authenticated and unauthenticated HTTP hosts

[Copilot]

Pull request overview

This PR adds a context-aware CORS policy to enhance security for the HTTP transport mode. The policy behaves differently based on the authentication mode: in development mode (unauthenticated), it restricts requests to localhost origins only to prevent CSRF attacks, while in production mode (authenticated), it allows all origins since JWT Bearer authentication validates all requests.

Changes:

• Introduced a new ConfigureCors() method that configures CORS policy based on the DangerouslyDisableHttpIncomingAuth flag
• Replaced the permissive "AllowAll" CORS policy with a context-aware "McpCorsPolicy"
• Updated both CreateHttpHost and CreateIncomingAuthDisabledHttpHost methods to use the new shared CORS configuration

[anuchandy]

thanks Vinay, lgtm