Reflect requested CORS headers dynamically

[haileyok]

Summary

• Remove the brittle static CORS request-header allow-list.
• Let browser preflights use the headers they actually requested, so new Bluesky client headers do not require another server change.

Changes

• Leave Echo’s AllowHeaders configuration empty, which makes Echo reflect Access-Control-Request-Headers in the preflight response.
• Extend the CORS regression test with an arbitrary x-future-client-header to verify that client-specific headers are handled dynamically.
• Keep reflected origins and credentials enabled for Cocoon’s intentionally open browser-client policy.

Validation

• go test ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• go test ./... -count=1
• go vet ./...
• go test -race ./server -run "TestCORSAllowsBrowserSpaceCredentialExchange|TestProxyResponseHeadersPreserveCocoonCORS" -count=1
• git diff --check

Review notes

• Follow-up to merged PR Allow Bluesky topics CORS requests #133.
• This changes browser preflight negotiation only; endpoint authentication and authorization remain unchanged.
• The fix must be deployed before retesting the Bluesky web client.