reject wildcard origin with credentials in is_origin_allowed

[uwezkhan]

With allowed_origins {"*"} and allow_credentials true, any request Origin is echoed back with credentials:

> Origin: https://evil.example
< Access-Control-Allow-Origin: https://evil.example
< Access-Control-Allow-Credentials: true

is_origin_allowed treats "*" (or an empty origin list) as allow-all without looking at allow_credentials, and create_cors_middleware reflects the request origin once credentials are on. The combination lets any site read authenticated cross-origin responses. The cors_config docs already say "*" is invalid with credentials, so this keeps the wildcard/empty-list allow-all path but gates it on credentials being off; with credentials on it falls through to the exact allowed_origins match (the validator path is unchanged).

Before: "*" + credentials reflects any origin alongside Access-Control-Allow-Credentials: true.
After: "*" + credentials only allows origins listed explicitly (or accepted by the validator); "*" without credentials still allows all and sends Access-Control-Allow-Origin: *.

Test in tests/networking_tests/cors_test drives the middleware headers and is_origin_allowed across these cases.