Always vary origin

The Vary header needs to be set in *all* responses to requests handled by pebbles-cors. If not, we risk that caches between server and client cache objects without CORS headers for all requests, even later requests with CORS headers. (We sometimes call these endpoints from browsers or monitoring tools without using CORS, and those requests gets cached by Varnish.)

Also, do not simply set Vary to Origin, but handle existing Vary header by appending Origin to it when not already included in the list.