Fix CORS header duplication in chained proxies

[BiosSystem]

Fixes #2853.

When Echo CORS middleware is run in a chained proxy setup (or in front of any handler copying upstream headers using Add), headers like Access-Control-Allow-Origin and Vary get duplicated in the response.

Changes:

• Run simple request CORS header writing inside a Before hook on the response. This allows the proxy's CORS config to cleanly Set the headers, overriding duplicated upstream headers from the proxy or downstream response copy.
• Implement addVaryHeader helper to merge and deduplicate Vary values case-insensitively.
• Add unit test simulating ReverseProxy behavior to verify headers are not duplicated.