CORS middleware: Vary handling, perf

[Zaczero]

Summary

Follow up to https://github.com/Kludex/starlette/pull/3065#issuecomment-3484250919

• Reviewed and revised Vary header handling.
• Swapped Sequences for Collections that are more generic, and allow for use of sets that have faster membership checks (common in CORSMiddleware).

Checklist

• [x] I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• [ ] I've updated the documentation accordingly.