quick follow up to ENG-6926. the HeaderValue::from_str function takes pretty much any ascii string, but we should validate these strings first to make sure we have the right format in terraform, where we set the value of ALLOW_ORIGIN_LIST

we already use the url crate in shared/backup_client and services/commtest

unit tests, tested that other schemes like ftp and missing ports don't work on staging