Fix proxy CORS and atcute DPoP compatibility

[haileyok]

Summary

• Accept standard public-JWK metadata emitted by atcute DPoP clients so Space credential issuance proofs validate.
• Preserve Cocoon CORS headers when proxying AppView responses so normal browser clients can read proxied responses.

Changes

• Allow and validate standard optional alg, use, kid, and key_ops members in embedded P-256 DPoP JWKs while retaining strict required-key and algorithm checks.
• Prevent handleProxy from overwriting Cocoon Access-Control-* headers with upstream headers, and merge upstream Vary values instead of replacing the local CORS dimensions.
• Add regression tests for atcute-style DPoP JWK metadata and proxied CORS-header preservation.

Validation

• go test ./... -count=1
• go vet ./...
• go test -race ./... -count=1
• git diff --check

Review notes

• Follow-up to merged PR Fix browser CORS for Space authentication #130; this commit must be deployed before retesting PDSLS or normal browser traffic.
• The atcute compatibility check is based on the published @atcute/oauth-crypto@1.0.1 proof/key shape; no live credential was used in validation.