ETag should consider CORS headers

TL;DR: I want the ETag to change when the `access-control-allow-origin` header is different but the response body is the same.

---

We are facing an issue right now with a couple moving parts working poorly together.

It's a bit difficult to explain but I'll try my best.

1. When sending a request from Chrome to a spec-compliant CDN, it will initially hit the express server.
1. The express server responds with the resource, CORS & Vary headers, and an ETag derived from the response body.
2. The CDN will cache the response headers and body.
3. Chrome will also cache the response headers and body.
2. When Chrome requests the resource from a different origin, it may take the ETag cached for a different Origin and send it to the CDN (this is spec-compliant).
1. This may then lead the CDN to respond with a 304 Not Modified, as the CDN may have a resource for the origin and ETag in the cache.
2. Responding with 304 will only return partial headers (explicitly excluding CORS headers; Some spec says it should NOT return CORS headers here).
3. This then leads Chrome to take the response from the cache and think that the Origins mismatch → throwing a CORS error.

This is kind of messed up, as all parties do comply with the specs, though when put together, the specs don't work nicely together.

The best way to fix this would be for the server to generate a different ETag when the `access-control-allow-origin` header differs.