Change CorsConfig.enabled to optional and add logic to infer it

[tjquinno]

Description

Resolves #7990
Resolves #8024

The PR changes CorsConfig#enabled to optional so we can tell if the value is ever explicitly set--either from code or config--on the CorsSupport builder.

If so, we use the explicit setting.

If not, we set it as follows:

• If no cors config was used, set enabled to false.
• If cors config was used, set enabled to true.

This prevents the auto-discovered CORS logic from enabling permissive CORS settings by default.

Note that this changes the CorsConfig#enabled() method API. In 4.0.0 it returns boolean. With these changes it will return Optional<Boolean>.

Documentation

Bug fix - no doc change

Release note information

In 4.0.0, the CorsConfig.Builder had the method boolean enabled() to return the builder's setting for whether CORS is enabled or not in the builder.

In 4.0.1, the method on the builder has changed to Optional<Boolean> enabled() so the caller can tell whether or not CORS was explicitly enabled or disabled or whether defaults should apply.