Improve CORS list properties combination logic

This commit allows CorsConfiguration#combine()
to differentiate permit default values set by
CorsConfiguration#applyPermitDefaultValues()
from values configured explicitly by the user.

Those permit default values will be overridden
by any user-provided ones while user-provided values
will be combined in an additive way, including
when "*" is specified.

Documentation has been improved accordingly.

Issue: SPR-15772

src/docs/asciidoc/web/webflux-cors.adoc

@@ -55,9 +55,10 @@ class or method-level `@CrossOrigin` annotations (other handlers can implement
 `CorsConfigurationSource`).
 
 The rules for combining global and local configuration are generally additive -- e.g.
-all global and all local origins. The only exception are those attributes where only a
-single value can be accepted such as `allowCredentials` and `maxAge`, in which case the
-local overrides the global value.
+all global and all local origins. For those attributes where only a single value can be
+accepted such as `allowCredentials` and `maxAge`, the local overrides the global value. See
+{api-spring-framework}/web/cors/CorsConfiguration.html#combine-org.springframework.web.cors.CorsConfiguration-[`CorsConfiguration#combine(CorsConfiguration)`]
+for more details.
 
 [TIP]
 ====

src/docs/asciidoc/web/webmvc-cors.adoc

@@ -55,9 +55,10 @@ class or method-level `@CrossOrigin` annotations (other handlers can implement
 `CorsConfigurationSource`).
 
 The rules for combining global and local configuration are generally additive -- e.g.
-all global and all local origins. The only exception are those attributes where only a
-single value can be accepted such as `allowCredentials` and `maxAge`, in which case the
-local overrides the global value.
+all global and all local origins. For those attributes where only a single value can be
+accepted such as `allowCredentials` and `maxAge`, the local overrides the global value. See
+{api-spring-framework}/web/cors/CorsConfiguration.html#combine-org.springframework.web.cors.CorsConfiguration-[`CorsConfiguration#combine(CorsConfiguration)`]
+for more details.
 
 [TIP]
 ====