Add context-aware CORS policy to enhance security

[g2vinay]

Add context-aware CORS policy for HTTP transport mode

• Development mode (unauthenticated): Restricts to localhost origins only to prevent CSRF attacks

  • Allows localhost/127.0.0.1/[::1] with any port (supports MCP Inspector, custom ports)
  • Protects against cross-site request forgery when --dangerously-disable-http-incoming-auth is used
  • Prevents malicious websites from accessing developer's Azure credentials via localhost endpoints

• Production mode (authenticated): Allows all origins safely

  • JWT Bearer authentication validates all requests regardless of origin
  • Required for MCP clients (GitHub Copilot in VS Code/Codespaces) from various origins
  • CORS is a browser mechanism; authenticated API doesn't need origin restrictions

Replaces permissive 'AllowAll' policy with context-aware 'McpCorsPolicy'
Implements ConfigureCors() method shared by both authenticated and unauthenticated HTTP hosts