feat: allow bypassing current CORS magic based on template config (#18706)

Solves https://github.com/coder/coder/issues/15096

This is a slight rework/refactor of the earlier PRs from @dannykopping
and @Emyrk:
- https://github.com/coder/coder/pull/15669
- https://github.com/coder/coder/pull/15684
- https://github.com/coder/coder/pull/17596

Rather than having a per-app CORS behaviour setting and additionally a
template level setting for ports, this PR adds a single template level
CORS behaviour setting that is then used by all apps/ports for
workspaces created from that template.

The main changes are in `proxy.go` and `request.go` to:
a) get the CORS behaviour setting from the template
b) have `HandleSubdomain` bypass the CORS middleware handler if the
selected behaviour is `passthru`
c) in `proxyWorkspaceApp`, do not modify the response if the selected
behaviour is `passthru`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for configuring CORS behavior ("simple" or "passthru")
at the template level for all shared ports.
* Introduced a new "CORS Behavior" setting in the template creation and
settings forms.
* API endpoints and responses now include the optional `cors_behavior`
property for templates.
* Workspace apps and proxy now honor the specified CORS behavior,
enabling conditional CORS middleware application.
* Enhanced workspace app tests with comprehensive scenarios covering
CORS behaviors and authentication states.

* **Bug Fixes**
  * None.

* **Documentation**
* Updated API and admin documentation to describe the new
`cors_behavior` property and its usage.
* Added examples and schema references for CORS behavior in relevant API
docs.

* **Tests**
* Extended automated tests to cover different CORS behavior scenarios
for templates and workspace apps.

* **Chores**
* Updated audit logging to track changes to the `cors_behavior` field on
templates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Callum Styan <callumstyan@gmail.com>

coderd/apidoc/swagger.json

@@ -10202,6 +10202,11 @@
 				"BuildReasonJetbrainsConnection"
 			]
 		},
+		"codersdk.CORSBehavior": {
+			"type": "string",
+			"enum": ["simple", "passthru"],
+			"x-enum-varnames": ["CORSBehaviorSimple", "CORSBehaviorPassthru"]
+		},
 		"codersdk.ChangePasswordWithOneTimePasscodeRequest": {
 			"type": "object",
 			"required": ["email", "one_time_passcode", "password"],
@@ -10525,6 +10530,14 @@
 						}
 					]
 				},
+				"cors_behavior": {
+					"description": "CORSBehavior allows optionally specifying the CORS behavior for all shared ports.",
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.CORSBehavior"
+						}
+					]
+				},
 				"default_ttl_ms": {
 					"description": "DefaultTTLMillis allows optionally specifying the default TTL\nfor all workspaces created from this template.",
 					"type": "integer"
@@ -14774,6 +14787,9 @@
 				"build_time_stats": {
 					"$ref": "#/definitions/codersdk.TemplateBuildTimeStats"
 				},
+				"cors_behavior": {
+					"$ref": "#/definitions/codersdk.CORSBehavior"
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"