docs(security): stop presenting CORS as an XSS defence

[santhiprakash]

Problem

docs/operating/security.md currently tells operators to set CORS headers such as Access-Control-Allow-Origin to prevent XSS. That is incorrect: CORS relaxes the Same-Origin Policy so a browser on another origin can read responses; it is not an XSS defence.

Reported in #2449. Confirmed still present on current main.

The same page has two sibling stale claims in the TLS section:

• "TLS will be added to Java exporters in the future." The JMX exporter already supports TLS, including mutual TLS (see its http/ssl integration tests).
• crypto/tls is linked via the retired golang.org/pkg/crypto/tls URLs (they redirect, but the canonical docs are on pkg.go.dev).

Triage / Root cause

The CORS sentence is in the API Security section and presents CORS as an XSS control. Maintainers already agreed in #2449 that CORS should not be mentioned as a defence against XSS.

Fix

• Reword the CORS sentence: set CORS if a browser app on another origin should be allowed to read non-mutating responses; CORS is not an XSS defence.
• Replace the Java TLS "in the future" sentence with the current JMX exporter TLS support.
• Point the three crypto/tls links at https://pkg.go.dev/crypto/tls.

Issue Number

Fixes #2449

Verification

• Read docs/operating/security.md on upstream/main @ 8ea3853e — the "to prevent XSS" wording, the Java "in the future" sentence, and the golang.org/pkg/crypto/tls links were all still present.
• Confirmed https://golang.org/pkg/crypto/tls redirects to https://pkg.go.dev/crypto/tls.
• Confirmed jmx_exporter ships MutualTLSWithAuthTest / MutualTLSWithCustomCiphersTest.

Notes / Risks

• Docs-only. No Prometheus server behaviour change.
• CORS is still documented, just not as an XSS control — operators who actually need cross-origin browser access still have the guidance.
• @RichiH as docs maintainer for the non-web-design surface (see MAINTAINERS.md).