Wildcard support for allowed_origins

[jimdigriz]

Similarly to #268, allowed_origins could do with wildcard support but also on the port number.

My use case is for a CLI tools authentication flow backed by Portier and presents http://localhost:*; the local port is dynamic as it is assigned by the OS and needs to be ephemeral (randomly chosen) to not clash with existing services.

Alternatively, maybe localhost could be a special edge case for wildcard'ing ports whilst everything else is just a wildcard at the sub-domain?