add vary: origin header when needed

[ruslantalpa]

Problem

when returning cors headers, origin is fixed the Vary header is needed for things to function properly

Access-Control-Allow-Origin: https://developer.mozilla.org
Vary: Origin

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin#cors_and_caching

fix for the issues flagged in this comment

Summary of changes

• add the vary header
• add a note related to finding a solution for when we don't have a cached configuration for the "allowed_origins"

[kszafran]

👌🏻

[github-actions]

9119 tests run: 8466 passed, 0 failed, 653 skipped (full report)

---

Code coverage* (full report)

• functions: 34.7% (8840 of 25482 functions)
• lines: 45.7% (71657 of 156722 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
5994c4f at 2025-07-31T15:09:05.746Z :recycle:}