Include protocol when checking internal domain for cross-origin resource sharing

[mitchellhenke]

🛠 Summary of changes

I noticed when working on #7785, that internal requests were not being skipped as intended, and it seems to be due to the request source including protocol AND domain, and us only comparing it against the domain. MDN has a fuller explanation, but the format and a few examples are:

Origin: null
Origin: <scheme>://<hostname>
Origin: <scheme>://<hostname>:<port>

Origin: https://developer.mozilla.org

On secure.login.gov, IdentityConfig.store.domain_name returns secure.login.gov, and I pulled the request headers:

Origin: https://secure.login.gov

which will never match 🙂

This PR adds https:// so that we skip the remaining checks as intended.

[zachmargolis]

LGTM