fix: cors filter should not store in local variable allowed origins

[yurem]

CorsFilter in doFilter method get allowed origins based on request and set them in AbstractCorsFilter.allowedOrigins before calling AbstractCorsFilter.doFilter. This is bad idea to pass them in such way because WebFilter is defined with asyncSupported = true. Hence second request can override this variable value. We can use:

request.setAttribute("clientAllowedOrigins", clientAllowedOrigins);

to pass client allowed origins to AbstractCorsFilter.doFilter