feat: scope Lambda origin to CloudFront domain

[jdebuseamazon]

Reason for this change

This change enhances the default security of the API handler by scoping Lambda access down to the deployed CloudFront domain or local host.

Description of changes

Added an optional ALLOWED_ORIGIN environment variable to Lambdas. If set then requests are restricted to this origin or localhost. Also updated a unit test impacted by this change

Updated the quick start guide

• CDK populates the ALLOWED_ORIGIN environment variable
• Terraform includes instructions for populating this environment variable via a second deployment

Description of how you validated changes

Built the AWS nx plugin and docs

pnpm nx compile nx-plugin
nx build docs

Ran the tests:

pnpm nx run @aws/nx-plugin:test -u

Ran the doc server:

nx start docs

• Followed the quick start guide from the local doc server with the AWS nx plugin linked to the locally built instance
• For both the CDK and Terraform versions
  • Modified the solution to use the echo API
  • Smoke tested deployed solution and a local instance
  • Confirmed that the ALLOWED_ORIGIN environment variable correctly blocked requests by temporarily changing this to an alternative URL and verifying that echo API calls from the deployed application failed

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.80%. Comparing base (6444a85) to head (99d7857).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #371   +/-   ##
=======================================
  Coverage   91.80%   91.80%           
=======================================
  Files          80       80           
  Lines        2697     2697           
  Branches      590      590           
=======================================
  Hits         2476     2476           
  Misses         85       85           
  Partials      136      136           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cogwirrel]

Thanks for this - will definitely be nice to configure CORS properly! :)

Please could we also do the same for FastAPI and Smithy to keep our API generators consistent? :)

[cogwirrel]

Great stuff, thanks so much Justin! 🚀