Non-wildcarded CORS settings do not work for GET requests

When configuring CORS Response Headers using hst:responseheaders or hst:allowedorigins using specific URLs, e.g. using "https://my.app.com" rather than "*", see [1], this works for OPTIONS requests but not for GET requests.

In the code in org.hippoecm.hst.core.container.CorsSupportValve#invoke, for GET, setAccessControlAllowOrigin is only called after isAllowedOriginResponseHeaderWildcard check.

Using originAllowed instead can be the fix here.

[1] https://documentation.bloomreach.com/14/library/concepts/page-model-api/configuration.html