Embedding app origin setting should allow multiple origins for the Access-Control-Allow-Origin header

[npretto]

Context

We're started using embedding-app-origin to make the embedding sdk work on other domains via Access-Control-Allow-Origin. This has a small issue as Access-Control-Allow-Origin should only return one origin (or "*") while we tell the users to give us a list of origins separated by a space:

A solution could be to change the following line

metabase/src/metabase/server/middleware/security.clj

Line 131 in ef15d0e

{"Access-Control-Allow-Origin" (embedding-app-origin)

to return the referrer if it's present in the list of allowed origins. We'll need to normalize the origins before doing the check.

We use the same setting for multiple headers, we should also double check if the formats are compatible.

[npretto]

For context, the PR closing this issue was reverted with this #43125 because it broke staging