fix(@angular/build): allow configuring Access-Control-Allow-Origin via headers option

[alan-agius4]

Removes the default Vite CORS origin: true configuration, allowing custom Access-Control-Allow-Origin header configurations to take effect when using the development server.

BREAKING CHANGE: The development server (ng serve) no longer automatically mirrors the request origin in the Access-Control-Allow-Origin response header by default. If your application relies on cross-origin requests during local development, you must now explicitly configure the required CORS headers using the headers option in your angular.json configuration.

Fixes #32923

[gemini-code-assist]

Code Review

This pull request modifies the Angular dev server's Vite configuration to remove the default Access-Control-Allow-Origin: true setting, meaning the Access-Control-Allow-Origin header will no longer be automatically mirrored. A new test case was added to verify that when the header is explicitly configured, it is correctly applied. The reviewer suggests adding another test to explicitly confirm that the Access-Control-Allow-Origin header is not set by default when no headers option is provided, to fully cover the breaking change in behavior.

[alan-agius4]

This PR was merged into the repository. The changes were merged into the following branches:

• main: b85ec67

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}