Forbid wildcard (*) CORS headers when credentials are true

[Vansh0204]

Description

This PR addresses issue #333 by ensuring that the * wildcard is not used in Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, or Access-Control-Expose-Headers response headers when Access-Control-Allow-Credentials is set to true, as required by the Fetch Standard.

Changes

• Origin: If origin: '*' (default) is set and credentials: true, the middleware now reflects the Origin request header and adds Vary: Origin.
• Methods: If methods: '*' is explicitly set and credentials: true, the Access-Control-Allow-Methods header is omitted from the response.
• Allowed Headers: If allowedHeaders: '*' is explicitly set and credentials: true, the Access-Control-Allow-Headers header is omitted from the response.
• Exposed Headers: If exposedHeaders: '*' is explicitly set and credentials: true, the Access-Control-Expose-Headers header is omitted from the response.

Verification

• Added a new test file test/issue-333.js covering all the above scenarios.
• All existing tests pass.
• Code coverage remains at 100%.