everything: safer CORS + loopback bind for HTTP transports

[TheodorNEngoy]

The Everything server's HTTP transports currently:

• Bind to all interfaces by default (app.listen(PORT))
• Use wildcard CORS (origin: "*") for Inspector direct connect

This is a common local-dev footgun when running an MCP server that exposes powerful tools: any LAN host can connect, and any website can issue browser requests.

Changes:

• Bind SSE + Streamable HTTP transports to 127.0.0.1 by default (override with HOST=0.0.0.0 when intentionally exposing)
• Replace wildcard CORS with a loopback-only allowlist by default (localhost/127.0.0.1/[::1])
• Add MCP_CORS_ORIGIN_REGEX to intentionally widen the browser allowlist
• Document the overrides in src/everything/README.md

No changes to the stdio transport.

[TheodorNEngoy]

Context: this change also removes the current high-severity baseline entries in #3295 (MCP Safety Scan CI), so once/if this merges we can shrink the baseline accordingly.