fix(transport): match explicit default ports in Origin allowlist

[DaleSeo]

Fixes #1268.

Motivation and Context

An allowed_origins entry with an explicit default port, like https://client.example:443, rejected the origin that browsers actually send, which is Origin: https://client.example. So the entry did not work in practice.

RFC 6454 treats an omitted port as the scheme's default port, and then removes that default port when serializing the origin. The matcher compared the missing port from the incoming request directly with the configured port. That meant a configured :443 could only match a client that explicitly included the port.

The fix resolves the effective port on the incoming origin before comparing it. That means 443 for https and 80 for http. The configured side stays unchanged.

How Has This Been Tested?

Add tests

Breaking Changes

None

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

[alexhancock]

Should it really permit any port, or if it's not listed should it permit only the default port for the scheme?

People can always configure it with a specific known port if they need one...

If we need the unconditional match, perhaps it would be better to introduce a syntax for specifying that like:

http://localhost:*