PYSEC-2026-4348: Permissive default CORS policy in vLLM

Before vLLM version 0.32.0, the OpenAI-compatible server configured Starlette CORSMiddleware to allow requests from all origins by default. A malicious web page could use a victim's browser to reach an unauthenticated vLLM server accessible on localhost, an internal network, or a VPN, call endpoints including model enumeration and chat completions, consume GPU resources, and read responses.