fix: use NoDecode for cors origins

[gadomski]

Description:

This re-enables the use of simple,comma,delimted,strings from environment variables for CORS_ORIGINS. Otherwise, the env var syntax needs to be an encoded json string, which is awkward.

E.g. without this fix you had to say CORS_ORIGINS=["http://a.test","http://b.test"]. Now you can say CORS_ORIGINS=http://a.test,http://b.test, which is how it's described in the CHANGELOG.

PR Checklist:

• pre-commit hooks pass locally
• Tests pass (run make test)
• Documentation has been updated to reflect changes, if applicable, and docs build successfully (run make docs)
• Changes are added to the CHANGELOG.

[gadomski]

Marking as draft, as we might have to do this to CORS headers as well.

[vincentsarago]

From pedantic settings doc

Complex types like list, set, dict, and sub-models are populated from the environment by treating the environment variable's value as a JSON-encoded string.

The fact that this lib used to support this is IMO not great and I would think that we should avoid this.

That's said in

stac-fastapi-pgstac/stac_fastapi/pgstac/app.py

Lines 91 to 94 in 8874baa

	if ext := os.environ.get("ENABLED_EXTENSIONS"):
	enabled_extensions = set(ext.split(","))

we only support , delimited string so I'll ✅ this PR for now but we might revisit this in the future