#2564 SECURITY.md: a page cors_origins lets in can have the server download image URLs, internal addresses too

Beschreibung

**What it changes.** One bullet of SECURITY.md's "What the server exposes" (CORS). With `"cors_origins"` listing a page (or `["*"]`), that page's `/v1` requests are accepted without a key when none is set (`origin_allowed`), and `http(s)` image URLs in them pass `_no_local_images` and are downloaded by the server (`Vision.download`, `urllib`, redirects followed) when it reads images. A failed download comes back as a 400 ("the image URL could not be read: ... Connection refused") with the CORS header, so the page can probe addresses on the user's network. The bullet now says so, says to list only pages you trust, and that files on the PC are still not read for such a page.

**What it leaves alone.** The server: this follows from the setting the user chose rather than from a gate the server misses, so it is documented, not changed. Without `cors_origins` a foreign page gets 403 before anything is fetched. Every other line of SECURITY.md.

**How it was checked.** A test against `serve.server.serve(...)` with a fake vision encoder, `cors_origins: ["*"]`, an `Origin: http://evil.example` request with an `image_url` on `127.0.0.1`: the internal listener received the GET, and a closed port's error came back with `Access-Control-Allow-Origin: *`. Each sentence was checked against `_cors`, `_foreign_page`, `origin_allowed`, `_no_local_images` and `Vision.download` by a sub-agent reviewer (its two wording fixes are in). Found in a security read of `serve/server.py` (#544's invitation).

🤖 Generated with [Claude Code](https://claude.com/claude-code)