perf(cors): skip Python CORS call when Origin header is absent

[ZhuchkaTriplesix]

Context

• When set_cors is enabled, merge_config_response_headers in src/dispatch.rs calls Python CORSConfig.response_header_pairs(scope) on every response.
• oxyroute/cors.py returns [] when there is no permitted Origin, but the Python call still happens.

Problem

Cross-origin responses need CORS merge; same-origin and API-only traffic still pays Python callback overhead.

Proposed change

• In Rust, check scope headers for Origin (case-insensitive) before invoking Python.
• Optional: compile simple allow_origins=["*"] presets into static header pairs at registration.

Files

• src/dispatch.rs, oxyroute/cors.py, tests

Acceptance criteria

• CORS behaviour unchanged for requests with valid Origin.
• Responses without Origin skip Python response_header_pairs.
• Tests cover credentialed and wildcard configs.

Expected low-level impact

Fewer Python↔Rust roundtrips on non-CORS traffic when CORS is globally enabled.

[ZhuchkaTriplesix]

Shipped in #133 (merged to dev).