Track CORS middleware reflected Origin behavior for credentialed requests

[coderabbitai]

Summary

Track the CORS middleware change introduced in #1385 for credentialed cross-origin requests when OriginURL is configured as "*".

The pull request updates the middleware so that:

• when OriginURL == "*", the server reflects the incoming request's Origin header in Access-Control-Allow-Origin
• when OriginURL is set to a specific value, the configured value continues to be returned unchanged
• Access-Control-Allow-Credentials: true remains enabled

Rationale

Browsers reject responses that combine:

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Credentials: true

Without reflecting the request Origin in the wildcard configuration case, credentialed CORS requests can fail despite the server intending to allow them.

Affected areas

• pkg/server/http_server.go
• corsMiddleware
• CORS handling for both preflight OPTIONS requests and non-preflight requests

Acceptance criteria

• The middleware reflects the incoming Origin header when OriginURL == "*"
• The middleware preserves the configured static origin when OriginURL != "*"
• Responses remain compatible with browser credentialed CORS enforcement
• The issue remains linked to the implementation PR for traceability

Backlinks

• Pull request: CORS Reflect Origin #1385
• Requesting comment: CORS Reflect Origin #1385 (comment)

Requested by @dogancanbakir.