fix: never emit a wildcard Access-Control-Allow-Origin alongside credentials

[sridhar-3009]

Summary

When a CORS policy has allow_origins="*" and allow_credentials=True, the CORS middleware sends Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. Per the Fetch spec, a literal * for Access-Control-Allow-Origin is invalid when credentials are involved, and browsers reject the response outright for any fetch/XMLHttpRequest call made with credentials: 'include'. In practice this means a server configured this way returns a 200 with what looks like valid CORS headers, but every credentialed browser request against it silently fails at the network layer.

The middleware already has the correct fallback for named origins (echoing the specific origin instead of * when it's on the allow-list), it just wasn't applied to the wildcard case when credentials are also allowed.

Fix

In get_cors_middleware, only use the literal "*" for Access-Control-Allow-Origin when credentials are not allowed; otherwise echo back the request's own Origin, same as the non-wildcard path already does. This applies to both the preflight response and the actual (non-OPTIONS) response.

Test plan

• Added test_cors_preflight_request_allow_any_origin_with_credentials, covering both the preflight and the actual GET response for a wildcard-origin + credentials-enabled policy
• Reproduced the bug against main first (confirmed Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true were both sent) before applying the fix
• Full test suite: pytest tests/ → 1923 passed, 1 skipped
• black --check, isort --check-only, flake8 all clean on changed files