fix: set stricter cors header

[CrabNejonas]

This makes the CORS header more strict so that only requests from https://devtools.crabnebula.dev are allowed.

It also adds a UNSAFE_BYPASS_CLIENT_AUTH environment variable that can be set to bypass this stricter check (for local development)

resolves DR-580

[linear]

DR-580 fix: configure CORS in instrumentation

Right now CORS is configured to allow connections from any origin. Once we have an exact origin the DevTools UI is hosted at we should configure CORS to only accept connections from that origin.

[lucasfernog-crabnebula]

With this change we also need to include a .cargo/config.toml on our repo:

[env]
UNSAFE_BYPASS_CLIENT_AUTH = "true"

for development

(plus remembering to set that var for other projects we use for development)

[CrabNejonas]

With this change we also need to include a .cargo/config.toml on our repo:

[env]
UNSAFE_BYPASS_CLIENT_AUTH = "true"

for development

(plus remembering to set that var for other projects we use for development)

good call

[CrabNejonas]

Made this a compile-time check and added the config file