Handle CORS preflight for MCP proxy

[lorenzozanee]

Summary

Allowlisted browser requests to the MCP proxy could not complete CORS negotiation: preflight requests reached the MCP method handler and successful responses lacked CORS headers. This change handles allowed preflight requests in the existing exact Origin allowlist middleware and adds the corresponding headers to allowed responses.

Fixes #4297

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Focused unit tests for the origin middleware, go test ./pkg/transport/..., go vet ./pkg/transport/..., and git diff --check passed. The repository's task and golangci-lint commands were unavailable in the local environment, so their checklist items remain unchecked.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Does this introduce a user-facing change?

Yes. Browser clients from an explicitly allowed Origin receive a successful /mcp preflight and the CORS headers needed for MCP requests. Disallowed Origins remain rejected, and an empty allowlist remains pass-through without enabling CORS.

Special notes for reviewers

The existing exact Origin allowlist is the sole source of CORS permission: no wildcard or arbitrary Origin reflection is introduced. Suggested reviewers for the transport area are @JAORMX, @jhrozek, and @blkt.

Supersedes #6652 (原PR分支已删，按原提交重建）

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.09%. Comparing base (f3dfc9e) to head (1512e55).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6669      +/-   ##
==========================================
+ Coverage   79.08%   79.09%   +0.01%     
==========================================
  Files         785      785              
  Lines       78381    78390       +9     
==========================================
+ Hits        61989    62005      +16     
+ Misses      16387    16380       -7     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.