fix(deps): update dependency django-cors-headers to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
django-cors-headers (changelog)	^3.6.0 -> ^4.0.0

---

Release Notes

adamchainz/django-cors-headers (django-cors-headers)

v4.6.0

Compare Source

• Drop Django 3.2 to 4.1 support.

v4.5.0

Compare Source

• Drop Python 3.8 support.

• Support Python 3.13.

v4.4.0

Compare Source

• Support Django 5.1.

v4.3.1

Compare Source

• Fixed ASGI compatibility on Python 3.12.

  Thanks to Adrian Capitanu for the report in Issue #&#8203;908 <https://github.com/adamchainz/django-cors-headers/issues/908>__ and Rooyal in PR #&#8203;911 <https://github.com/adamchainz/django-cors-headers/pull/911>__.

v4.3.0

Compare Source

• Avoid adding the access-control-allow-credentials header to unallowed responses.

  Thanks to Adam Romanek in PR #&#8203;888 <https://github.com/adamchainz/django-cors-headers/pull/888>__.

• Support Django 5.0.

v4.2.0

Compare Source

• Drop Python 3.7 support.

v4.1.0

Compare Source

• Support Python 3.12.

v4.0.0

Compare Source

• Add CORS_ALLOW_PRIVATE_NETWORK setting, which enables support for the Local Network Access draft specification.

  Thanks to Issac Kelly in PR #&#8203;745 <https://github.com/adamchainz/django-cors-headers/pull/745>__ and jjurgens0 in PR #&#8203;833 <https://github.com/adamchainz/django-cors-headers/pull/833>__.

• Remove three headers from the default "accept list": accept-encoding, dnt, and origin.
  These are Forbidden header names <https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name>__, which means requests JavaScript can never set them.
  Consequently, allowing them via CORS has no effect.

  Thanks to jub0bs for the report in Issue #&#8203;842 <https://github.com/adamchainz/django-cors-headers/issues/842>__.

• Drop the CORS_REPLACE_HTTPS_REFERER setting and CorsPostCsrfMiddleware.
  Since Django 1.9, the CSRF_TRUSTED_ORIGINS setting has been the preferred solution to making CSRF checks pass for CORS requests.
  The removed setting and middleware only existed as a workaround for Django versions before 1.9.

• Add async support to the middleware, reducing overhead on async views.

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone US/Eastern, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.