Make serve_header.py listen on localhost and limit its CORS header (#5564)

Without a bind address in serve_header.yml, the server listened on all
interfaces, so any machine on the network could fetch the header and
trigger make runs in the working trees. It now listens on localhost
unless configured otherwise; bind: null restores the old behavior.

The header was also sent with Access-Control-Allow-Origin: *, letting
any web page read it. CORS is only needed because Compiler Explorer
downloads #include <https://...> headers in the browser, so the header
now goes only to https://godbolt.org and https://compiler-explorer.com,
configurable with cors_origins.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

tools/serve_header/serve_header.yml.example

@@ -10,6 +10,13 @@
 #  cert_file: localhost.pem
 #  key_file: localhost-key.pem
 
-# address and port for the server to listen on
-# bind: null
+# address and port for the server to listen on; by default, only this machine
+# can connect. Binding to a network address, or to null for all interfaces,
+# lets other machines connect, and every request runs make in a working tree.
+# bind: localhost
 # port: 8443
+
+# origins whose web pages may read the header (CORS)
+# cors_origins:
+#   - https://godbolt.org
+#   - https://compiler-explorer.com