fix(19.3-06): cors:<profile> headers on every response of the route (CR-01)

- Router.wrap applies the route's profile outside recovery, body limit and
  locale, whatever its position in the list or the group nesting
- bufferedResponse.commit merges Vary instead of replacing it
- TestCORSProfileHeadersOnRefusals, TestCORSProfileVaryKeptWithHandlerVary
  required by name in the gate

modules/surf/cors.go

@@ -251,7 +251,9 @@ func LoadCORSProfiles(cfg *compass.Config) (map[string]CORSConfig, error) {
 }
 
 // profileMiddleware sets the profile's CORS headers on a non-OPTIONS request;
-// preflights reach the OPTIONS route compile registers instead.
+// preflights reach the OPTIONS route compile registers instead. wrap runs it
+// outermost, outside the body limit, locale and recovery, so every answer of
+// the route carries the headers, refusals and recovered panics included.
 func (p *corsPolicy) profileMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodOptions {