fix(grpc-web): don't override Access-Control-Allow-Origin header in response

[tzssangglass]

Description

Fixes #6834

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[HalilOzkan]

I think we should also respect and don't override all CORS headers in the grpc-web plugin if already set by the CORS plugin

[tzssangglass]

I think we should also respect and don't override all CORS headers in the grpc-web plugin if already set by the CORS plugin

yes, this is how this PR is handled.

According to the grpc-web requirements for CORS: https://github.com/grpc/grpc-web/blob/master/doc/browser-features.md#cors-support

Access-Control-Allow-Credentials, Access-Control-Allow-Methods, Access-Control-Allow-Headers is clear, I understand what you mean, the cors plugin may have more precise control over the three header.