CANTINA-913: Match protocol in CORS header

[rebeccahum]

Description

Only allow HTTPS origins on VIP

Changelog Description

Filter added: vip_only_https_origins

Only allow HTTPS origins on VIP

Pre-review checklist

Please make sure the items below have been covered before requesting a review:

• This change works and has been tested locally (or has an appropriate fallback).
• This change works and has been tested on a Go sandbox.
• This change has relevant unit tests (if applicable).
• This change uses a rollout method to ease with deployment (if applicable - especially for large scale actions that require writes).
• This change has relevant documentation additions / updates (if applicable).
• I've created a changelog description that aligns with the provided examples.

Pre-deploy checklist

• VIP staff: Ensure any alerts added/updated conform to internal standards (see internal documentation).

Steps to Test

1. curl 'https://example.net/wp-admin/admin-ajax.php?action=heartbeat' -H 'Origin: http://example.net' -I and expect to see access-control-allow-origin returned
2. Apply patch
3. Do step 1 again and expect to not see access-control-allow-origin returned

[codecov]

Codecov Report

Attention: Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 30.44%. Comparing base (3183a91) to head (91b0b55).
Report is 36 commits behind head on develop.

Files with missing lines	Patch %	Lines
001-core.php	75.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #4964      +/-   ##
=============================================
+ Coverage      30.42%   30.44%   +0.02%     
  Complexity      4826     4826              
=============================================
  Files            290      290              
  Lines          21329    21321       -8     
=============================================
+ Hits            6489     6492       +3     
+ Misses         14840    14829      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rinatkhaziev]

Per Slack conversation with @rebeccahum this is not blocked anymore.