Limit Webpack dev server allowed CORS origins

[aduth]

🛠 Summary of changes

Updates local Webpack development server to limit allowed origins for CORS to the expected local web server origin (usually http://localhost:3000).

This is motivated by a security advisory GHSA-67mh-4wv8-2f99 which addresses a similar issue in a package that we don't use in the IdP.

The risk here is fairly minimal, since the dev server only serves files out of the public/ directory.

An original approach considered disabling CORS altogether. CORS is enabled because we specify the crossorigin attribute on script assets in local development, and we specify this attribute because it allows for better error messages in pages using React.js (see #6126).

📜 Testing Plan

Verify in local development that there are no issues loading JavaScript. It should be pretty evident if JavaScript is not working, because the "Here's how you know" USA banner will display as expanded by default.

[aduth]

The reason for creating a separate environment variable copying PORT is that the behavior of Foreman is to assign a different port value for each process (see ddollar/foreman#110, ddollar/foreman#714). If we just passed PORT, it would actually assign 3200, since this is the third process in the Procfile.