CORS middleware: Vary handling, perf

[Zaczero]

Summary

Follow up to #3065 (comment)

• Reviewed and revised Vary header handling.
• Swapped Sequences for Collections that are more generic, and allow for use of sets that have faster membership checks (common in CORSMiddleware).

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.