Add proper CORS preflight origin validation

[silverwind]

I noticed that the recently introduced CORS preflight validation in 270fa6d was not properly performed for option values other than * which can lead to a vulnerability of unintended cross-origin resource access if the user configures a actual origin option value instead of a wildcard. The server would unconditionally accept a preflight request to a resource even if origins do not match.

With this commit any other option value than * or null leads to a comparision of the mandatory Origin client header and 200 is only sent if they match.

I did a few tests using curl to validate it works as expected.

[codecov-io]

Codecov Report

❗ No coverage uploaded for pull request base (master@ca3b9aa). Click here to learn what that means.
The diff coverage is 0%.

@@            Coverage Diff            @@
##             master    #5740   +/-   ##
=========================================
  Coverage          ?   37.76%           
=========================================
  Files             ?      325           
  Lines             ?    47681           
  Branches          ?        0           
=========================================
  Hits              ?    18005           
  Misses            ?    27081           
  Partials          ?     2595

Impacted Files	Coverage Δ
routers/repo/http.go	38.58% <0%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ca3b9aa...9fd01f8. Read the comment docs.