starknet_transaction_prover: add CORS validation unit tests

[avi-starkware]

Covers build_cors_layer (empty/wildcard/allowlist branches), cors_mode
labelling, and normalize_cors_allow_origins (scheme/host/userinfo/path/query
rejection, default-port handling, deduplication of equivalent origins, and
wildcard collapsing the rest of the list).

Includes a port_80_retained_on_https case: url normalizes away a
scheme-default port at parse time, so https://host:80 is the input that tells a
correctly-scoped default-port rule apart from one that strips any :80. Nothing
covered that before.

[reviewable-StarkWare]

This change is 

[avi-starkware]

• starknet_transaction_prover: cover the CORS layer attachment in start_server #15036
• starknet_transaction_prover: unit-test both overload-rejection paths #15035
• starknet_transaction_prover: unit-test the JSON-RPC error mapping #15034
• starknet_transaction_prover: add deployment smoke script and guide #14052
• starknet_transaction_prover: add manual testing guide #14404
• starknet_transaction_prover: drop stale dead_code allow on RpcVirtualBlockExecutor #14740
• starknet_transaction_prover: extract shared server test utils #14739
• starknet_transaction_prover: make RPC error spec test exhaustive via enum #14051
• starknet_transaction_prover: add TLS integration tests #14050
• starknet_transaction_prover: add ServiceConfig validation tests #14049
• starknet_transaction_prover: add CORS validation unit tests #14048 👈 (View in Graphite)
• main-v0.14.4

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
Test-only change with no runtime or configuration behavior modifications.

Overview
Adds cors_test and registers it from server.rs under #[cfg(test)]. No production CORS behavior changes.

The new suite exercises build_cors_layer (disabled when the origin list is empty, allowlist echo vs omit, wildcard *, OPTIONS preflight allowing POST), cors_mode labels (disabled / wildcard / allowlist), and normalize_cors_allow_origins (rejecting bad schemes, missing host, userinfo, path/query/fragment, and unparseable strings; canonicalizing default ports on http/https; keeping non-default ports; deduping equivalent origins; wildcard collapsing or ignoring invalid siblings while preserving order for distinct origins). Includes port_80_retained_on_https so default-port stripping is not over-applied to https://…:80.

^{Reviewed by Cursor Bugbot for commit c9610b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

There hasn't been any activity on this pull request recently, and in order to prioritize active work, it has been marked as stale.
This PR will be closed and locked in 7 days if no further activity occurs.
Thank you for your contributions!