V5: CORS config not overriding defaults and upload api does not restricts to .pdf files only
- Node.js version: 22
- NPM version: 10.9
- Strapi version: 5.7
- Database: mysql
- Operating system: macos
- Is your project Javascript or Typescript: js

### Describe the bug

I have been configuring the strapi-cors in middleware file but it is not reflecting in the actual working i have tried various ways, but i don't know why this is not wokring, i know that there are already issue out there where it is the same issue but their solutions are not working for me.

below is the config I am using :

```
  {
    name: 'strapi::cors',
    config: {
      origin: 'http://localhost:3002', 
      origin: ['http://localhost:3002'], // have also tried this one
      credentials: false, // Allow credentials (cookies, tokens, etc.)
      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],
      headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],
      maxAge: 31536000,
      keepHeadersOnError: false,
    },
  },
```

in the middleware file

packages/core/core/src/middlewares/cors.ts

I don't know such a basic thing as basic as cors is not working and it is using defaults

i have also tried updating vite.config.js file but no output.

another issue :

I am unable to set restrict upload plugin to accept only pdf files, i have search many stackoverflow issues and their solutions, don't know why as basic things as managing the file extensions are not been able to controlled with this :

below is the config i have used in plugin.js file :

```
 upload: {
    config: {
      // sizeLimit: 5 * 1024 * 1024, // 5 MB
      provider: 'local',
      providerOptions: {
        sizeLimit: 5 * 1024 * 1024, // 5 MB
        extensions: ['.pdf'],
        allowedTypes: ['application/pdf'],
      },
      actionOptions: {
        upload: {
          allowedTypes: [
            'application/pdf', // Allow PDFs
            // 'image/webp', // Allow WebP images
            // 'image/jpeg', // Allow JPG images
            // 'image/png', // Allow PNG images
          ],
        },
      },
    },
  },
```


does not work at all

maintainers kindly help me how to make this work or else i will have to make another backend now while security assessment before deployment of the application.

