[PM-32249] Allow custom desktop protocol in CORS

[dani-garcia]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32249
https://bitwarden.atlassian.net/browse/VULN-411

📔 Objective

The desktop application is currently loading files using the privileged file:// scheme. If the application has an XSS vulnerability, the attacker could use this to read arbitrary files on the user's machine. To solve this, we have to define a custom scheme and a scheme handler for it, which gives us control over what files are and aren't accessible. The problem is that one of those privileges that we lose is the ability to ignore CORS, so now server has to specifically allow CORS from the custom scheme origin for the desktop app to be able to make requests.

This PR allows server to correctly accept CORS requests from the custom desktop scheme. Once versions of the server without this change are out of support, we'll be able to update the clients to use the new scheme.

POC on clients using a custom scheme: bitwarden/clients#19208
Some more info on electron's page: https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols

📸 Screenshots

[github-actions]

Checkmarx One – Scan Summary & Details – 39c6e105-9c6c-4881-bc19-1974deeb2936

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.45%. Comparing base (0c9b97b) to head (345acd9).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Core/Utilities/CoreHelpers.cs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7080      +/-   ##
==========================================
- Coverage   56.45%   56.45%   -0.01%     
==========================================
  Files        2013     2013              
  Lines       88112    88115       +3     
  Branches     7863     7863              
==========================================
+ Hits        49742    49743       +1     
- Misses      36554    36556       +2     
  Partials     1816     1816              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud