Refactor CORS handler

[wxiaoguang]

The CORS code has been unmaintained for long time, and the behavior is not correct.

This PR tries to improve it. The key point is written as comment in code. And add more tests.

Fix #28515
Fix #27642
Fix #17098

[wxiaoguang]

No, it is not "breaking", these options are all no-op for long time.

So, nothing is breaking.

[GiteaBot]

I was unable to create a backport for 1.21. @wxiaoguang, please send one manually. 🍵

go run ./contrib/backport 28587
...  // fix git conflicts if any
go run ./contrib/backport --continue

[wiktor-k]

Sorry for the delay but does this PR really fix #27642 ?

I get the same error that the issue was reporting:

$ curl -X 'GET'   'https://try.gitea.io/api/v1/users/wiktor/keys'   -H 'accept: application/json' -i -H Origin:https://github.com
HTTP/2 401
alt-svc: h3=":443"; ma=2592000
cache-control: max-age=0, private, must-revalidate, no-transform
content-type: application/json;charset=utf-8
date: Mon, 25 Dec 2023 15:55:53 GMT
server: Caddy
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-length: 73

{"message":"token is required","url":"https://try.gitea.io/api/swagger"}

(I've checked the version endpoint and it seems to contain this merged PR).

Thanks for your time! 👋

[wxiaoguang]

Sorry for the delay but does this PR really fix #27642 ?

I get the same error that the issue was reporting:

I guess "try.gitea.io" doesn't enable CORS handler.

If you have deployed your own Gitea instance, could you try to set [cors].ENABLED=true in your app.ini and restart and try?

[wiktor-k]

If you have deployed your own Gitea instance, could you try to set [cors].ENABLED=true in your app.ini and restart and try?

I can confirm this makes all the difference and I'm seeing the headers. (I wonder why CORS is not the default though, but okay).

Thanks for helping me diagnose that! (and sorry for the delay) 👋