Allow Bluesky labeler CORS requests

[haileyok]

Summary

• Allow the atproto-accept-labelers request header used by the Bluesky web client.
• Fix the notification-list preflight that currently returns 204 but omits a requested header, causing Chrome to block the actual request as CORS.

Changes

• Add atproto-accept-labelers to Cocoon’s explicit CORS allow-header list.
• Extend the browser CORS regression test to cover the labeler header.

Validation

• go test ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• go test ./... -count=1
• go vet ./...
• go test -race ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• git diff --check

Review notes

• This is a follow-up to merged PR Fix proxy CORS and atcute DPoP compatibility #131.
• The fix must be deployed before retrying the Bluesky web client; PDSLS is already working with the merged DPoP compatibility changes.