set Access-Control-Allow-Origin - same as v1 server

[henfiber]

The new server implementation (--v2) does not set the "Access-Control-Allow-Origin" header leading to CORS errors in applications (encountered while using an Obsidian extension).

The v1 server version does this:

res.set_header("Access-Control-Allow-Origin", req.get_header_value("Origin"));

Applied the same logic to the v2 server and tested that the header is properly set and CORS is allowed.

[cjpais]

@jart, do you think this is a reasonable default for the v2 server. I think it's fine