fix(middleware): classify CORS preflight per Fetch standard

[sonnemusk]

Problem

CORS middleware treated every OPTIONS request as a preflight and short-circuited with 204, so user-registered OPTIONS handlers never ran.

Per the Fetch standard, a preflight is an OPTIONS request that includes both:

• Origin
• Access-Control-Request-Method

These are not preflights and should reach the next handler:

curl -X OPTIONS localhost:8080/hello
curl -X OPTIONS -H 'Origin: https://example.com' localhost:8080/hello

This one is a preflight and should still be handled by the middleware:

curl -X OPTIONS \
  -H 'Origin: https://example.com' \
  -H 'Access-Control-Request-Method: PUT' \
  localhost:8080/hello

Fixes #2534.

Change

• Add isCORSPreflight requiring method + Origin + ACR-Method
• Non-preflight OPTIONS continues the chain via next(c)
• Real preflights keep the existing short-circuit + CORS headers
• Still copy router Allow onto OPTIONS responses when present

Tests

• TestIsCORSPreflight
• TestCORS_NonPreflightOPTIONSPassThrough (covers the three cases above)
• Existing preflight cases updated to send Access-Control-Request-Method

go test ./middleware/ -run 'CORS|IsCORSPreflight'

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.35%. Comparing base (dcb05f0) to head (a67ea8f).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3060   +/-   ##
=======================================
  Coverage   93.34%   93.35%           
=======================================
  Files          43       43           
  Lines        4735     4737    +2     
=======================================
+ Hits         4420     4422    +2     
  Misses        192      192           
  Partials      123      123           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.