fix: pass allowed methods to CORS middleware

[vissersg]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues
#669

Describe the solution you've provided

When setting up the CORS middleware each router now passes in a list of methods that it supports, and the middleware handler uses that list to set AllowedMethods. This replaces the hardcoded GET method to ensure all methods are properly handled.

Describe alternatives you've considered

Provide a clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context about the pull request here.

---

Note

Low Risk
Scoped to local dev-server SDK CORS configuration; no auth or production API changes.

Overview
Fixes browser CORS preflights on dev-server SDK routes that use REPORT (and other non-GET verbs) by aligning CORS AllowedMethods with each subrouter’s real methods instead of a shared middleware that only allowed GET.

The shared CorsHeaders variable is replaced with CorsHeadersForMethods, which builds gorilla CORS from a per-route method list. /eval and /sdk/evalx/{envId} pass GET and REPORT; /sdk/goals/{envId} passes GET. Route Methods(...) definitions reuse the same slices (plus OPTIONS).

Adds TestCorsHeaders to assert OPTIONS preflight success for allowed methods and rejection (no Access-Control-Allow-Origin) for disallowed ones.

^{Reviewed by Cursor Bugbot for commit a073dd3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.