perf(cors): skip Python CORS merge when Origin is absent

[ZhuchkaTriplesix]

Summary

• Native CORS response merge skips response_header_pairs when the request has no Origin header
• Behaviour unchanged when Origin is present (wildcard + credentialed covered by tests)
• Counting subclass asserts zero Python calls without Origin

Closes #108

Test plan

• pytest tests/test_cors.py tests/test_cors_units.py
• cargo clippy --all-targets -- -D warnings
• Manual: CORS-enabled app, request without Origin has no ACAO; with Origin still merges