fix: set headers for CORS

[michalsn]

Description
This PR fixes a bug where CORS was not set correctly due to the response object being returned in the before filter. Now all CORS headers are set in the before filter, and the after filter is no longer used.

This change should not break anyone's code.

Fixes #9431

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[kenjis]

If a dev creates an new Response in a controller, the CORS header will not be added.
E.g, what if using redirect()?

[michalsn]

If a dev creates an new Response in a controller, the CORS header will not be added.
E.g, what if using redirect()?

Fair point.