CVE-2026-25478: Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

CORS origin validation can be bypassed because the allowed-origins allowlist is compiled into a regex without escaping metacharacters (notably .). An allowed origin like https://good.example can match https://goodXexample, resulting in Access-Control-Allow-Origin being set for an untrusted origin