Allow not returning any access control headers if the Origin is not allowed to access the resource

## Describe the feature

At the moment the library does not allow handling the scenario in which the origin is not allowed to access the resource: it expects `options. origin` to always return a string. That leads to developers having to come up with a "workaround" configuration ([for example here](https://github.com/koajs/cors/issues/52#issuecomment-413887382) or [here](https://github.com/koajs/cors/issues/75#issue-768946654)) which is not ideal:

- I'd rather not return any allowed domains to the caller if the caller is not allowed to call my API in the first place as it might undisclose details unnecessarily.
- [Returning `false/undefined` from `origin` function causes the middleware to be completely ignored](https://github.com/koajs/cors/blob/0f3f948b9b8f00163a47de1b82e413bfef9b4a96/index.js#L64) which seems to be a feature of this library as [there's a unit test](https://github.com/koajs/cors/blob/0f3f948b9b8f00163a47de1b82e413bfef9b4a96/test/cors.test.js#L156-L166) that proves this behaviour.
- Returning a `null` is not a good practice because of security issues as described [in this issue](https://github.com/koajs/cors/issues/89).

If the request `Origin` is not allowed, the middleware should be able to respond to pre-flight requests immediately with no `Access-Control` headers being returned at all.

## Checklist

- [x] I have searched through GitHub issues for similar issues.
- [x] I have completely read through the README and documentation.

Start by reading index.js around line 64 and the existing behavior covered by test/cors.test.js lines 156-166. Trace how an origin that is not allowed is handled for pre-flight requests. Done means the middleware can respond to such requests without returning Access-Control headers, while preserving the existing behavior for allowed origins.

Written by the indexing model from the issue text.