HTTP: Add CORS Header for private network access

[toss156]

Chrome will start sending a CORS preflight request ahead of any private network request for a subresource, which asks for explicit permission from the target server. This preflight request will carry a new header, Access-Control-Request-Private-Network: true, and the response to it must carry a corresponding header, Access-Control-Allow-Private-Network: true.

The aim is to protect users from cross-site request forgery (CSRF) attacks targeting routers and other devices on private networks. These attacks have affected hundreds of thousands of users, allowing attackers to redirect them to malicious servers.

Reference content:
Make sure to maintain the markdown structure.
https://developer.chrome.com/blog/private-network-access-preflight/
#2787 RTC: Ensure private network requests are made from secure contexts

---

TRANS_BY_GPT3

[kirakiseki]

Hi! I'm currently facing the same CORS problem, after searching for documents, I think the header added in this PR should be set to "Access-Control-Allow-Private-Network" instead of "Access-Control-Request-Private-Network" which is used in preflight requests.

You can also refer to the same documents as those in the description of this PR.

If there are still any other problems, plz feel free to reach me out! Thanks:)

[darik07]