feat: add configurable HLS CORS allowlists

tests/Cors/OriginTest.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Plugin\AzuraCastOnDemandHls\Tests\Cors;
+
+use InvalidArgumentException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Plugin\AzuraCastOnDemandHls\Cors\Origin;
+
+#[CoversClass(Origin::class)]
+final class OriginTest extends TestCase
+{
+    public function testItCanonicalizesAWebOrigin(): void
+    {
+        self::assertSame('https://aifrequency.org', Origin::normalize('HTTPS://AIFrequency.org/'));
+        self::assertSame('https://www.aifrequency.org', Origin::normalize('https://www.aifrequency.org'));
+        self::assertSame('https://aifrequency.org:8443', Origin::normalize('https://aifrequency.org:8443'));
+    }
+
+    public function testItRejectsPathsAndUnsafeOriginForms(): void
+    {
+        foreach (['*', 'null', 'https://aifrequency.org/path', 'https://[email protected]', 'file:///tmp/a'] as $origin) {
+            try {
+                Origin::normalize($origin);
+                self::fail(sprintf('%s should be rejected.', $origin));
+            } catch (InvalidArgumentException) {
+            }
+        }
+    }
+}