fix(cors)!: doesn't return access-control-allow-origin header when origin is disallowed

[aaharu]

resolves #355

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.46%. Comparing base (a58d7c9) to head (d476c72).
Report is 187 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #870      +/-   ##
==========================================
+ Coverage   77.83%   79.46%   +1.63%     
==========================================
  Files          47       43       -4     
  Lines        4286     3292     -994     
  Branches      611      798     +187     
==========================================
- Hits         3336     2616     -720     
+ Misses        933      673     -260     
+ Partials       17        3      -14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pi0]

Can you please add a regression test?

[aaharu]

It's going to be a conflict, so I'll work on it after #856.

[aaharu]

IMO, Access-Control-Allow-Origin: null doesn't need to be supported.
Because it should not be used.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#null