fix: cors (#621)

* fix: dont (re)generate client secret with auth type none

* fix(cors): allow Origin from request

* feat: add origin allow list and fix some core issues

* rename migration

* fix UserIDsByDomain

* check origin on userinfo

* update oidc pkg

internal/project/model/application_view.go

@@ -1,8 +1,9 @@
 package model
 
 import (
-	"github.com/caos/zitadel/internal/model"
 	"time"
+
+	"github.com/caos/zitadel/internal/model"
 )
 
 type ApplicationView struct {
@@ -25,6 +26,7 @@ type ApplicationView struct {
 	NoneCompliant              bool
 	ComplianceProblems         []string
 	DevMode                    bool
+	OriginAllowList            []string
 
 	Sequence uint64
 }