fix(cors)!: doesn't return access-control-allow-origin header when origin is disallowed

[aaharu]

resolves #355

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.45%. Comparing base (a58d7c9) to head (de522e9).
Report is 187 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #870      +/-   ##
==========================================
+ Coverage   77.83%   79.45%   +1.62%     
==========================================
  Files          47       43       -4     
  Lines        4286     3291     -995     
  Branches      611      797     +186     
==========================================
- Hits         3336     2615     -721     
+ Misses        933      673     -260     
+ Partials       17        3      -14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pi0]

Can you please add a regression test?

[aaharu]

It's going to be a conflict, so I'll work on it after #856.

[aaharu]

IMO, Access-Control-Allow-Origin: null doesn't need to be supported.
Because it should not be used.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#null