binding-http: 404 responses do not include CORS headers

[Pranav-0440]

Description

While working with the CORS tests introduced in #1486, I noticed that 404 responses do not include Access-Control-Allow-Origin headers when an Origin header is present in the request.

This causes browsers to block error responses due to missing CORS headers.

Current Behavior

For unknown routes, defaultRoute in http-server.ts returns:

res.writeHead(404);
res.end("Not Found");

No CORS headers are set.

Impact

Browsers performing cross-origin requests will block 404 responses
because Access-Control-Allow-Origin is missing, making debugging
and proper client-side error handling difficult.

Regression Test

A unit test has been added to reproduce and prevent this issue.