Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard

[jcwilson]

When making a preflight request, the browser provides no indication as to whether the actual subsequent
CORS request will pass up credentials (read: cookies). However, unless the preflight response explicitly allows
the request's Origin in the Access-Control-Response-Header, the browser will fail the CORS check and
prevent the actual follow-up CORS request. This means that responding to preflight requests with the *
wildcard when allow_credentials=True is not sufficient to allow preflighted credentialed requests.

The current workaround is to provide an equivalently permissive allow_origin_regex pattern, but this would
appear to be a POLA violation. If one wishes to allow calls from all origins, regardless of the allow_credentials
setting, then allow_origins=["*"] should be sufficient to express that intent.

The simple_response() code already performs similar logic which currently only applies to non-preflighted
requests since the browser would never make a preflighted request that hits said code due to this issue:

# If request includes any cookie headers, then we must respond
# with the specific origin instead of '*'.
if self.allow_all_origins and has_cookie:
    headers["Access-Control-Allow-Origin"] = origin

This PR just brings the two halves inline with each other.

See the relevant MDN CORS docs here:

When used as part of a response to a preflight request, this indicates whether or not the actual request can
be made using credentials. Note that simple GET requests are not preflighted, and so if a request is made for
a resource with credentials, if this header is not returned with the resource, the response is ignored by the
browser and not returned to web content.

Note: This could be considered an interface-breaking change and demand a stronger version bump if starlette
follows a strict semver policy. Servers that that currently specify allow_origins="*" instruct the browser to
block credentialed CORS calls that required preflight authorization. Adopting this behavior would allow these
calls through and could result in an unexpected relaxation of their current effective security rules. However, it
looks like starlette is still pre-1.0.0, so maybe this just means a minor version bump?