switch development origin verification to be opt-in rather than opt-out (#77395)
To avoid breaking local development proxies and more complex setups,
this ensures that we only block cross-origin development requests when
opting into the configuration. In a future major release, this will not
be opt-in, and will require explicitly providing the allowed origins
that can access the special `/_next` endpoints.
This adds a warning when a cross origin request is detected that would
be blocked without explicit configuration.
Fixes #77073
Fixes #77253
Fixes #77344