fix(cors): append access-control-max-age header to preflight response

[aaharu]

resolves #854

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.45%. Comparing base (a58d7c9) to head (4ba3732).
Report is 177 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #856      +/-   ##
==========================================
+ Coverage   77.83%   79.45%   +1.62%     
==========================================
  Files          47       43       -4     
  Lines        4286     3291     -995     
  Branches      611      797     +186     
==========================================
- Hits         3336     2615     -721     
+ Misses        933      673     -260     
+ Partials       17        3      -14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pi0]

Can you please add a regression test?

[aaharu]

I added tests and fixed the Access-Control-Expose-Headers issue as well.
https://fetch.spec.whatwg.org/#http-responses

An HTTP response to a CORS request that is not a CORS-preflight request can also include the following header:

Access-Control-Expose-Headers