[Test] Transport tests: CORS on vs off (Origin validation path)

[cloud-nitrostack]

Expand transport tests for CORS on vs off (Origin validation path)

Summary: Middleware behavior differs when enableCors is true vs false. Tests should lock that in.

Where to change: typescript/packages/core/src/core/transports/__tests__/transports.test.ts (and related).

Acceptance criteria:

• With CORS off: invalid Origin vs Host → 403 (or documented behavior).
• With CORS on: preflight and headers behave as expected for at least one happy path.

Suggested labels: test, security

---

Source: docs/STARTER_ISSUES_REVIEW.md — edit in-repo first, then sync GitHub issues if needed.