Support comma-separated HMIS_HOSTNAME values for cors config

[gigxz]

Please squash merge this PR

Description

Support comma-separated HMIS_HOSTNAME value. In production, this is only used to inform the cors config and for Okta.

For now, just raise if we have a multi-HMIS setup with okta. Omniauth code could probably be adapted if we need to support multi-HMIS okta installations in the future.

Multi-HMIS setup for local development is not supported.

Related to epic https://github.com/open-path/Green-River/issues/6612

🚨 I haven't meaningfully tested this locally, beyond ensuring that the cors init doesn't barf at the input. I can deploy to QA to test it, but will need to coordinate with devops to change the existing HMIS_HOSTNAME=qa-hmis.openpath.host to HMIS_HOSTNAME=qa-hmis.openpath.host,qa-hmis-2.openpath.host

Type of change

• [x] New feature (adds functionality)

Checklist before requesting review

• [x] I have performed a self-review of my code
• [ ] I have run the code that is being changed under ideal conditions, and it doesn't fail
• [x] My code includes comments and/or descriptive variable names to help other engineers understand the intent (or not applicable)
• [x] My code follows the style guidelines of this project (rubocop)
• [ ] I have updated the documentation (or not applicable)
• [ ] If it's not obvious how to test this change, I have provided testing instructions in this PR or the related issue

[gigxz]

@eanders here was my assessment on each of those:

1. SeedMaker usage is only for Development (enforced by an env check). Local dev doesn't support multi-HMIS anyway, we would need to set up a second cert to have 2 host names. Probably worth doing but will be a separate ticket. I'll push a commit to update it in anticipation anyway
2. setup.rake usage removed in https://github.com/greenriver/hmis-warehouse/pull/4747
3. base_controller.rb like you said, only for development. Will reference in a ticket around that

[gigxz]

Tested this on QA, works as expected!