Remove OpenApi CORS default support

[sberyozkin]

Fixes #28397

Users should set CORS Filter properties themselves (example, quarkus.http.cors.enabled=true and quarkus.http.cors.origins=* or quarkus.http.cors.origins=http://localhost:8080,http://quarkus.io, etc) if they want to access an OpenApi endpoint which requires CORS protection.
Migration note will follow

[sberyozkin]

@maxandersen FYI, if a wildcard open api CORS access is really needed, quarkus.http.cors=true and quarkus.http.cors.origins=* will do - IMHO it makes sense to have a single source where CORS in managed (CORS filter) as opposed to individual extensions choosing to do some specific CORS simplifications

[quarkus-bot]

Failing Jobs - Building ef303ec

Status	Name	Step	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 11
✔️	JVM Tests - JDK 17
✖	JVM Tests - JDK 17 MacOS M1	Set up runner	⚠️ Check →	Logs	Raw logs
✔️	JVM Tests - JDK 18

[sberyozkin]

@stuartwdouglas Can you have a look please if you can get a chance ? This PR is consistent with #29692. It is worth trying to get it into 2.16.0.CR1 to let users check if no real side-effects are introduced, and eliminate confusing warning as mentioned by @yrodiere, and make SAST scanners happy too which don't like a wildcard hardcoded.

[sberyozkin]

Hi @gsmet @phillip-kruger Can you please consider reviewing it ? FYI, in 2.16.CR1, the default Vert.x HTTP CORSFilter does not enable a wildcard by default, therefore, if the application requires CORS support in 2.16 CR1, they will have to enable Vert.x HTTP CORS even if someone wants a CORS Origin wildcard.

Therefore the code in OpenApiHandler which allows a wildcard CORS is effectively a dead code in 2.16 CR1 - the situation where the application itself does not need CORS but OpenAPI does is unrealistic IMHO. It is a good opportunity to clean it up for 2.16.Final

[phillip-kruger]

LGTM

[gsmet]

@sberyozkin could you please add a note to the 2.17 migration guide?

Also please do not advise to use *.

[sberyozkin]

@gsmet Sorry, I missed your comment, we already updated the docs and earlier migration guide related to *,
https://github.com/quarkusio/quarkus/wiki/Migration-Guide-2.16#no-wildcard-origin-support-by-default-for-cors-filter
and
https://quarkus.io/guides/http-reference#support-all-origins-in-devmode.

I just updated the 3.0 guide:
https://github.com/quarkusio/quarkus/wiki/Migration-Guide-3.0#openapi

Thanks