fix(binding-http): include CORS headers for 404 responses

[Pranav-0440]

Closes #1495

Description

This PR ensures that 404 responses include Access-Control-Allow-Origin
when an Origin header is present in the request.

Previously, unknown routes returned 404 without CORS headers,
causing browsers to block cross-origin error responses.

Changes

• Added a regression test to verify CORS behavior for 404 responses
• Updated defaultRoute in http-server.ts to include:
  • Access-Control-Allow-Origin
  • Vary: Origin

Motivation

Extends the CORS coverage introduced in #1486 and improves
standards compliance by ensuring consistent CORS behavior
for all HTTP responses, including 404 errors.

[Copilot]

Pull request overview

This PR addresses issue #1495 by adding CORS headers to 404 responses returned by the defaultRoute handler. When an Origin header is present in a request to an unknown route, the server now reflects the origin in the Access-Control-Allow-Origin response header along with a Vary: Origin header.

Changes:

• Updated defaultRoute in http-server.ts to include CORS headers (Access-Control-Allow-Origin and Vary: Origin) when an Origin header is present
• Added two tests to http-server-cors-test.ts: one attempting to verify 404 CORS behavior and another testing preflight with custom headers

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
packages/binding-http/src/http-server.ts	Added CORS header logic to defaultRoute for 404 responses
packages/binding-http/test/http-server-cors-test.ts	Added two tests, one for 404 CORS (though implementation is flawed) and one for preflight with custom headers

[egekorkan]

Coming from me and @danielpeintner: @Pranav-0440 we are not able to review this many PRs (more than 10 across here and EdiTDor). Please focus on less and make sure you understand the codebase. We will prefer less but higher quality PRs over too many PRs for our decision process. Using AI tooling is fine but you still need to understand what you are changing

[Pranav-0440]

Thanks @egekorkan for the feedback, that makes sense.
I’ll focus on fewer PRs and make sure I understand the codebase more thoroughly before opening new ones. I’ll prioritize improving the existing PRs rather than submitting many changes at once.