Add Private Network Access support in CORSMiddleware

[dm1sh]

Summary

Chromium-based browsers now enforce requests from websites in public network to localhost or private network endpoints and from private to localhost to "ask for permission" from server with OPTIONS pre-flight request. See more in their blog post. It is also applied to navigation fetches (e.g. iframes, popups): blog post

For it I added allow_private_network field in CORSMiddleware constructor as discussed in #2509. Also, I renamed former preflight_response to cors_preflight_response to add pna_preflight_response method to support pre-flight request in no-cors mode. Tests were also updated to cover new functionality.

I invite other contributors and maintainers to work on this pull request to be merged in future. Google is going to enforce various restrictions in their platform, so our instruments must be ready to deal with it!

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.

[Kludex]

Is there any reason why you ignore the access-control-request-method on the pna logic?

Also... Do we need this separation on pna and cors? The logic is very similar.