Return explicit origin in CORS response when credentials are allowed

[Kludex]

• Closes CORSMiddleware does not provide explicit origin although Authorization header is present #1832.

When allow_origins=["*"] and allow_credentials=True, the simple response path now returns the explicit request origin instead of *. This aligns with the preflight path, which already does this since #1113.

The previous approach inspected request headers (cookies) to decide when to echo the origin. This is unreliable - the server can't observe the client's credentials mode from request headers alone. Instead, we use allow_credentials as the signal, same as django-cors-headers and envoy-proxy.

Supersedes #1824, #2506, #3127, #3134.