CrossOriginFilter does not return Vary header on no-cors mode

[vbrown37]

Jetty version(s)
11.0.13

Java version/vendor
openjdk version "11.0.16" 2022-07-19
OpenJDK Runtime Environment (build 11.0.16+8-post-Ubuntu-0ubuntu118.04)
OpenJDK 64-Bit Server VM (build 11.0.16+8-post-Ubuntu-0ubuntu118.04, mixed mode, sharing)

OS type/version
Linux 5.15.0-71-generic #78-Ubuntu SMP Tue Apr 18 09:00:29 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Description
When running your server with the CrossOriginFilter default filter, OPTIONS responses do not return a Vary header on no-cors requests.
So, others cors requests to the same resource uses the no-cors request cached headers and lack cors headers such as Origin or Access-Control-Allow-Origin.

As explained here, https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches :
In particular, consider what happens if Vary is not used and a server is configured to send Access-Control-Allow-Origin for a certain resource only in response to a CORS request. When a user-agent receives a response to a non-CORS request for that resource (for example, as the result of a navigation request), the response will lack Access-Control-Allow-Origin and the user agent will cache that response. Then, if the user-agent subsequently encounters a CORS request for the resource, it will use that cached response from the previous non-CORS request, without Access-Control-Allow-Origin.

After opening this below issue, the submitted fix doesn't seem to fix this issue.
#1927

How to reproduce?

1. Configure your server to use Jetty's default CrossOriginFilter.
2. Load a resource through your browser with a no-cors request, the Vary: Origin header is not present on the OPTIONS response due to no-cors.
3. Load the same resource with a cors request, your user-agent won't include the Origin & Access-Control-Allow-Origin header due to caching, the request will be rejected.