CORS proxy: Fix custom origin validation during deployment

[brandonpayton]

Motivation for the change, related issues

We allow customizing the list of origins supported by the CORS proxy, but there is a bug in the deployment script that rejects valid origins within the custom origin list.

Implementation details

This PR:

• Fixes the validation regex to accept port numbers.
• Fixes the validation regex to accept arbitrary TLDs.
• Makes the CUSTOM_SUPPORTED_ORIGINS_SPACE_SEPARATED list a variable instead of a secret so maintainers can edit the list directly. With a secret, the only way items can be added and removed is to know the current value of the secret, but GitHub does not expose the current value.

Testing Instructions (or ideally a Blueprint)

• CI
• Manually trigger CORS proxy deployment from this PR branch

[brandonpayton]

This works, and I was able to deploy an update so a separate self-hosted Playground web app could use the CORS proxy with a custom origin.