Allow Bluesky topics CORS requests

[haileyok]

Summary

• Allow the x-bsky-topics request header used by the Bluesky web client.
• Fix the app.bsky.unspecced.getTrends preflight that otherwise blocks the actual request as CORS.

Changes

• Add x-bsky-topics to Cocoon’s explicit CORS allow-header list.
• Extend the browser CORS regression test to cover the topics header.

Validation

• go test ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• go test ./... -count=1
• go vet ./...
• go test -race ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• git diff --check

Review notes

• This is a follow-up to merged PR Allow Bluesky labeler CORS requests #132.
• The fix must be deployed before retrying the Bluesky web client; the current live preflight is expected to omit this header until deployment.