`Access-Control-Allow-Origin` not behaving as the docs say

### Version Information

Server Version: v2.0.8
CLI Version (for CLI related issue):

### Environment

OSS

### What is the expected behavior?

https://hasura.io/docs/latest/graphql/core/deployment/graphql-engine-flags/config-examples.html#configure-cors

https://github.com/hasura/graphql-engine/blob/master/docs/graphql/core/deployment/graphql-engine-flags/config-examples.rst#id1

`Access-Control-Allow-Origin` header should default to `*`.

### Keywords

CORS

### What is the current behavior?

The `Origin` header determines what `Access-Control-Allow-Origin` header will be.

### How to reproduce the issue?

1. Install
2. Run a query with `Origin` header
3.

### Screenshots or Screencast

### Please provide any traces or logs that could help here.

```sh
root@graphql5:~/pokeapi# curl -i -k 'http://localhost:8080/graphql/v1beta' \
-H 'origin: https://notexistent.invalid' \
--data-raw '{}'
HTTP/1.1 404 Not Found
Transfer-Encoding: chunked
Date: Thu, 16 Sep 2021 13:23:37 GMT
Server: Warp/3.3.14
Access-Control-Allow-Origin: https://notexistent.invalid
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,OPTIONS
Content-Type: application/json; charset=utf-8

{"path":"$","error":"resource does not exist","code":"not-found"}
```

### Any possible solutions?

Change the line below to `*`

### Can you identify the location in the source code where the problem exists?

https://github.com/hasura/graphql-engine/blob/71ae144aa623c156064ffe21eb38020ccf315a7a/server/src-lib/Hasura/Server/Middleware.hs#L60

### If the bug is confirmed, would you be willing to submit a PR?

yes

---

Not sure if you have an injection problem as well, here.

Start at server/src-lib/Hasura/Server/Middleware.hs around line 60 and compare the CORS behavior with the linked configuration documentation. Reproduce the response with the provided curl command using an Origin header, then verify the default Access-Control-Allow-Origin behavior matches the documented expectation and add or update the relevant test if one is present nearby.

Written by the indexing model from the issue text.