Add CORS headers to OAuth client metadata and JWKS endpoints
Authorization servers fetch these URLs cross-origin during PAR. Without
Access-Control-Allow-Origin, some AS implementations reject the client with
invalid_client_metadata (Unable to obtain client metadata).
Made-with: Cursor