[BUG] CrossFilter compiles origin regex on every CORS request

## Description
When `allowedOrigin.originRegex` is configured and the origin is not in the explicit allow-set, `allowCors = Pattern.matches(originRegex.trim(), origin)` recompiles the regex on every request on the WebFilter chain (Netty event loop).

## Location
```
shenyu-web/.../filter/CrossFilter.java:94
```

## Impact
Per-CORS-request regex compile when the regex allow-list path is used. Minor at low RPS, measurable for high-RPS public APIs relying on regex origins.

## Suggested fix
Compile `originRegex` once at config-load time into a `java.util.regex.Pattern` field; call `.matcher(origin).matches()`.

## Related existing issue(s)
None

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Start in shenyu-web/.../filter/CrossFilter.java at line 94, then trace how allowedOrigin is loaded and initialized. Move regex compilation to that configuration path and use the compiled pattern for matching; done means the regex is not compiled for each CORS request while existing origin matching behavior remains unchanged.

Written by the indexing model from the issue text.