fix: pass allowed methods to CORS middleware

[vissersg]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues
#669

Describe the solution you've provided

When setting up the CORS middleware each router now passes in a list of methods that it supports, and the middleware handler uses that list to set AllowedMethods. This replaces the hardcoded GET method to ensure all methods are properly handled.

Describe alternatives you've considered

Provide a clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context about the pull request here.

---

Note

Low Risk
Low risk: narrowly scoped change to dev server CORS configuration plus a focused test; main risk is unintended method/CORS regressions for affected endpoints.

Overview
Updates the dev server SDK CORS middleware to be method-aware by replacing the hardcoded GET allowed-method list with CorsHeadersForMethods(methods...).

Route subrouters under routes.go now pass their supported methods (e.g., GET/REPORT) into the CORS middleware and reuse the same list when registering OPTIONS handlers. Adds cors_test.go to verify preflight behavior allows configured methods and rejects others.

^{Written by Cursor Bugbot for commit 982b4fe. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.