[Backport] CVE-2023-0704: Insufficient policy enforcement in DevTools

Manual cherry-pick of patch originaly reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/4106102:
DevTools: reject debugging web socket connections with a defined Origin header

Unless the browser is started with a new flag `--remote-allow-origins=<origin>[,<origin>, ...]`. The star origin `*` allows all origins.
This CL should not affect non-browser clients such as Puppeteer and WebDriver. It affects DevTools e2e tests in the hosted mode which is fixed in [1]. It should not affect features like remote debugging that
don't use web sockets.

[1]: https://crrev.com/c/4112007

Bug: chromium:1385982
Change-Id: I721f7db3167ebab63416c8a1f48281735f063e48
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4106102
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Danil Somsikov <dsv@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1085812}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461071
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

0 files changed, 0 insertions, 0 deletions