fix(sec-90): remove '*' wildcard bypass from authenticateOrigin

[aris1009]

Summary

• Drop the `"*"` short-circuit in `authenticateOrigin()` so the origin allowlist cannot be globally disabled.
• Behavior change: a literal `*` in `--trusted-origins` no longer bypasses the host-vs-origin check; only exact matches are honored.
• Fork divergence from upstream; required for the SEC-84/SEC-90 hardening track.

Test plan

• `./test/node_modules/.bin/jest --testPathPattern "node/http.test"` (49 passed)
• Verify no internal deployment relies on `--trusted-origins=*` (none expected — the flag has never been wired in our deployments; see sibling PR rudderlabs/rudder-sources#3349)