[build-tools] pass the website origin to serve-sim

[gwdp]

Why

serve-sim needs to know which expo.dev origin may call it and frame it. We passed the CORS origin through the EAS_SIMULATOR_METRICS_CORS_ORIGIN env var and the frame ancestor from websiteOrigin(env)

How

• Build --cors-origin and --frame-ancestor from websiteOrigin(env).
• Stop reading EAS_SIMULATOR_METRICS_CORS_ORIGIN.
• --cors-origin does not exist in serve-sim 0.2.2. Release serve-sim with feat(preview): apply the cors policy to all routes serve-sim#172 first, then merge this.

Test Plan

CI

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.41%. Comparing base (1672bcd) to head (b83f4df).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4437      +/-   ##
==========================================
- Coverage   72.41%   72.41%   -0.00%     
==========================================
  Files         972      972              
  Lines       46319    46317       -2     
  Branches     9954     9953       -1     
==========================================
- Hits        33537    33535       -2     
  Misses      11787    11787              
  Partials      995      995              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[linear-code]

ENG-26861

[github-actions]

✅ Thank you for adding the changelog entry!