feat(cors): validate allow_origins

[spacewander]

Fix #4717

Signed-off-by: spacewander spacewanderlzx@gmail.com

What this PR does / why we need it:

Pre-submission checklist:

• Did you explain what problem does this PR solve? Or what new features have been added?
• Have you added corresponding test cases?
• Have you modified the corresponding document?
• Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first

[tzssangglass]

and OPTIONS response header return the allow-control-allow-origin header, should this PR handle it?

[spacewander]

We already return that header for the OPTIONS response.