Reject wildcard origin in CORS config instead of toggling credentials (#67502)

The Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true
combination is invalid per the CORS spec and browsers refuse to honour any
response that does so. The previous fix (#66503) added an
access_control_allow_credentials toggle, but allow_credentials=False would
break Airflow's UI on any deployment where API and UI are on different
origins, so that knob has no realistic use case.

Drop the toggle, always send credentialed CORS, and fail loudly at startup
with AirflowConfigException if access_control_allow_origins contains "*"
so operators see the bad configuration immediately instead of debugging
mysterious CORS errors in the browser.

Closes #67193 (the revert is no longer needed once the underlying
misconfiguration is rejected directly).