CORS: Support regular expressions for origin to match against

This commit adds regular expression support for the allow-origin
header depending on the value of the request `Origin` header.

Relates #5601
Closes #6891
I think the test framework might complain about this if it's not properly unset. Yet, I we can mute that by extending
`    private static final String[] IGNORED_INVARIANT_PROPERTIES = { ...` in `AbstractRandomizedTest#186`