This is to support custom origin checking in the Overleaf real-time service.

Changes:

• Overhaul origins option to allow a regex, function, string or boolean, or an array of any mix of these
• Change origins option default to disallow any origin
• Extend origins option to allow a function
• Remove htmlfile transport
• Remove flashsocket transport

This still falls back to checking the referrer header when origin is missing. This is a questionable practice and modern versions of socket.io don't do this. The referrer header also has the path, unlike the origin, which means we have to handle that in the origins option, probably using a regex. I've opted for a a minimal change that simply allows a function to be passed into the origins option, which receives the origin/referrer and the request object. If the origins setting is not a function, it behaves exactly as before, and the default is still to allow any origin.

This will fix https://github.com/overleaf/internal/issues/22644, in combination with some small tweaks to the check the origin in the real-time service.

We'll need to create a tag (probably 0.9.19-overleaf-11) once this is merged so that we can point the real-time dependency to the new version.