Support regex CORS origins in SecurityPolicy

*Description*:

This is a concrete proposal for the regex-based CORS origin matcher @zhaohuabing suggested in https://github.com/envoyproxy/gateway/pull/8708#issuecomment-4279528447

Allow CORS origin matching with regular expressions so users can selectively allow dynamic origins such as `https://preview-123.example.com`, where a hostname wildcard like `https://*.example.com` is too broad.

Add `cors.allowOriginRegexes`, a list of RE2 regular expressions matched against the full `Origin` header value (scheme, host, and port if present):

```yaml
spec:
cors:
allowOrigins:
- https://app.example.com
allowOriginRegexes:
- 'https://preview-[0-9]+\.example\.com'
```

- An origin is allowed when it matches any entry in either list (OR).
- Exact origins, hostname wildcards, and `"*"` stay in the existing `allowOrigins`, so there is only one spelling for those cases.
- Invalid patterns follow the existing SecurityPolicy handling: `Accepted=False` and a 500 response on affected routes.
- A regular expression that matches the literal string `"*"` is rejected, because Envoy's CORS filter treats any matcher that matches `"*"` as allow-all (https://github.com/envoyproxy/envoy/blob/v1.39.1/source/extensions/filters/http/cors/cors_filter.cc#L208-L215). Use `allowOrigins: ["*"]` to allow every origin explicitly.

Implementation: #9966

Review the SecurityPolicy CORS configuration described in the issue and the linked implementation in pull request #9966. Check how the existing allowOrigins handling reports invalid configuration and how affected routes are tested; done means the proposed regex behavior and rejection rules are covered by the implementation and tests.

Written by the indexing model from the issue text.