cors: reject unexpected cors requests

[wbpcode]

Title: [One line description](cors: reject unexpected cors requests)

Description:

Now, the unexpected cors requests (like some required headers lost) will be proxied to upstream directly to let the upstream to make the final decision.

This actually doesn't match our instuition. We even add a specific note to explain the behavior to our users. See https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/cors_filter

You maybe better if we can provide an option to reject unexpected cors requests, like OPTIONS requests without origin header, etc.

[optional Relevant Links:]

Any extra documentation required to understand the issue.