fix: restrict ADK Web cross-origin defaults

[lethanhsang188]

Summary

• Default ADK Web CORS origins to an empty list instead of allowing every origin.
• Apply configured CORS origins to the /run_live WebSocket endpoint instead of hard-coding wildcard origins.
• Add regression coverage for default-deny and explicit-origin behavior.

Tests

• ./mvnw -pl dev -Dtest=AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev -Dtest=AdkWebServerTest,AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev clean test

[hemasekhar-p]

Hi @lethanhsang188, thank you for your contribution! We appreciate you taking the time to submit this pull request. As per contribution policy, please ensure your PR consists of a single commit. Could you please change your commits accordingly?

[lethanhsang188]

Thanks for pointing this out. I rebased the branch onto the latest main and squashed the PR to a single commit (d67bd777).

Local verification:

• ./mvnw -pl dev -Dtest=AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev -Dtest=AdkWebServerTest,AdkWebCorsConfigTest,WebSocketConfigTest test
• ./mvnw -pl dev clean test

All passed.