CANTINA-913: Match protocol in CORS header

[rebeccahum]

Description

Only allow HTTPS origins on VIP

Changelog Description

Filter added: vip_only_https_origins

Only allow HTTPS origins on VIP

Pre-review checklist

Please make sure the items below have been covered before requesting a review:

• This change works and has been tested locally (or has an appropriate fallback).
• This change works and has been tested on a Go sandbox.
• This change has relevant unit tests (if applicable).
• This change uses a rollout method to ease with deployment (if applicable - especially for large scale actions that require writes).
• This change has relevant documentation additions / updates (if applicable).
• I've created a changelog description that aligns with the provided examples.

Pre-deploy checklist

• VIP staff: Ensure any alerts added/updated conform to internal standards (see internal documentation).

Steps to Test

1. curl 'https://example.net/wp-admin/admin-ajax.php?action=heartbeat' -H 'Origin: http://example.net' -I and expect to see access-control-allow-origin returned
2. Apply patch
3. Do step 1 again and expect to not see access-control-allow-origin returned

[codecov]

Codecov Report

Attention: 1 lines in your changes are missing coverage. Please review.

Comparison is base (746f135) 29.19% compared to head (e477bfc) 28.77%.
Report is 161 commits behind head on develop.

Files	Patch %	Lines
001-core.php	75.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #4964      +/-   ##
=============================================
- Coverage      29.19%   28.77%   -0.43%     
+ Complexity      4745     4742       -3     
=============================================
  Files            278      278              
  Lines          20899    20900       +1     
=============================================
- Hits            6101     6013      -88     
- Misses         14798    14887      +89     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

This pull request has been marked stale because it has been open for 60 days with no activity. If there is no activity within 7 days, it will be closed.

This is an automation to keep pull requests manageable and actionable and is not a comment on the quality of this pull request nor on the work done so far. Closed PRs are still valuable to the project and their branches are preserved.