[web_server] Add CORS origin checking with allowed_origins (#17530)

tests/components/web_server/common_v2.yaml

@@ -5,3 +5,6 @@ web_server:
   port: 8080
   version: 2
   compression: br
+  enable_private_network_access: true
+  allowed_origins:
+    - https://app.esphome.io

tests/components/web_server/common_v3.yaml

@@ -4,6 +4,9 @@ packages:
 web_server:
   port: 8080
   version: 3
+  # allowed_origins can be set independently of Private Network Access
+  allowed_origins:
+    - https://app.esphome.io
   sorting_groups:
     - id: sorting_group_1
       name: "Group 1 Diplayed Last"