Accept only an origin written exactly as a browser sends it (closes #61)

access_control_allow_origin is now "*", or http or https, a host that is
an IP address as net/netip writes it (IPv6 in brackets) or a lowercase
host name whose last part contains a letter, and an optional port 1-65535
with no leading zero that is not the scheme's default. The value must
equal the origin rebuilt from those parts; anything else aborts startup
naming the key, its variable and the value. README.md and
config.example.yml say an origin is scheme, host and optional port,
exactly as the browser sends it.

Model: opus-5-5

config.example.yml

@@ -84,7 +84,8 @@ downstream_timeout: 60s
 
 # The origin a browser lets read pixa's responses, sent as the CORS
 # Access-Control-Allow-Origin header: "*" (the default) is any site;
-# otherwise one origin, scheme and host only, such as https://example.com
+# otherwise one origin: scheme, host and optional port, exactly as the
+# browser sends it, such as https://example.com
 access_control_allow_origin: "*"
 
 # Maximum disk cache size in bytes. Explicit values are used exactly as