erp5_web: add Vary Origin to hateoas

This fixes an issue :
When we work on two web apps in two different domains
but using the same erp5 as storage backend,
the allow origin response header was equal to one sole
domain for the two web apps.

bt5/erp5_web/ToolTemplateItem/caching_policy_manager.xml

@@ -263,7 +263,7 @@
                             </item>
                             <item>
                                 <key> <string>_vary</string> </key>
-                                <value> <string>Cookie, Authorization</string> </value>
+                                <value> <string>Cookie, Authorization, Origin</string> </value>
                             </item>
                           </dictionary>
                         </state>