Bump django-cors-headers from 3.14.0 to 4.0.0 in /requirements

[dependabot]

Bumps django-cors-headers from 3.14.0 to 4.0.0.

Changelog

Sourced from django-cors-headers's changelog.

4.0.0 (2023-05-12)

• Add CORS_ALLOW_PRIVATE_NETWORK_ACCESS setting, which enables support for the Local Network Access draft specification.

  Thanks to Issac Kelly in PR [#745](https://github.com/adamchainz/django-cors-headers/issues/745) <https://github.com/adamchainz/django-cors-headers/pull/745>__ and jjurgens0 in PR [#833](https://github.com/adamchainz/django-cors-headers/issues/833) <https://github.com/adamchainz/django-cors-headers/pull/833>__.

• Remove three headers from the default "accept list": accept-encoding, dnt, and origin. These are Forbidden header names <https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name>__, which means requests JavaScript can never set them. Consequently, allowing them via CORS has no effect.

  Thanks to jub0bs for the report in Issue [#842](https://github.com/adamchainz/django-cors-headers/issues/842) <https://github.com/adamchainz/django-cors-headers/issues/842>__.

• Drop the CORS_REPLACE_HTTPS_REFERER setting and CorsPostCsrfMiddleware. Since Django 1.9, the CSRF_TRUSTED_ORIGINS setting has been the preferred solution to making CSRF checks pass for CORS requests. The removed setting and middleware only existed as a workaround for Django versions before 1.9.

• Add async support to the middleware, reducing overhead on async views.

Commits

• e97a976 Version 4.0.0
• 1580ab1 Improve unreleased CHANGELOG entries and order
• 54b8ac6 [pre-commit.ci] pre-commit autoupdate (#860)
• 71557f7 Add Local Network Access support (#833)
• 404ddfa Upgrade requirements (#859)
• 806adad [pre-commit.ci] pre-commit autoupdate (#858)
• 11e91d0 Tidy test views (#857)
• 0418c2d Use HTTPS URLs everywhere (#856)
• 0ab5847 Remove forbidden headers from tests (#855)
• 01a7beb Improve allow methods docs and default (#854)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.