fix(cors): reflect request origin when credentials is true with wildcard (#4813)

* fix(cors): reflect request origin when credentials is true with wildcard

Per the Fetch spec, Access-Control-Allow-Origin must not be '*' when
credentials mode is 'include'. Browsers reject these responses.

When origin is '*' and credentials is true, reflect the actual request
origin instead of the wildcard. Also set Vary: Origin in this case
since the response now varies by request origin.

Fixes #4811

* test(cors): add tests for credentials with wildcard origin

Cover the case where origin: '*' and credentials: true should reflect
the request Origin header instead of sending *.

* add more tests

---------

Co-authored-by: Yusuke Wada <yusuke@kamawada.com>