Proxito: update CORS settings

[humitos]

• Only add CORS headers on community site
• Explicit host on Access-Control-Allow-Origin
• Only query the database if the host ends with RTD_EXTERNAL_VERSION_DOMAIN
• Add more tests

Continuation of #10737

[stsewd]

We need to add the origin header to vary if the origin is set per-origin instead of *, similar to

https://github.com/adamchainz/django-cors-headers/blob/24f9145c5845c7eaa4182356cb5957d6a9d5a907/src/corsheaders/middleware.py#L97-L99

see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#cors_and_caching.

But again, we should be fine using *, the most important part here is that we aren't enabling this in .com yet.

[humitos]

We need to add the origin header to vary if the origin is set per-origin instead of *

I added the Vary header.

[stsewd]

Pushed some changes:

• Use * and allow this for .org only for now.
• Use the header constants from the corsheader package.

Using * simplifies things since we don't need to add any custom logic or worry about caching, and also disallows requests that send credentials in cross site requests. I'm going to test this more on .com, but with this behavior we should be fine.

Next step I would like to add these headers per view instead of having it in the middleware, having it per-view it's more scoped, and we don't have to query the DB again.

[humitos]

Looks great! Thanks for jumping in into this PR 🚀