fix: pass allowed methods to CORS middleware

[vissersg]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues
#669

Describe the solution you've provided

When setting up the CORS middleware each router now passes in a list of methods that it supports, and the middleware handler uses that list to set AllowedMethods. This replaces the hardcoded GET method to ensure all methods are properly handled.

Describe alternatives you've considered

Provide a clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context about the pull request here.

---

Note

Overview
Replaces the dev server’s single GET-only CORS middleware with CorsHeadersForMethods, so each SDK route subrouter advertises the HTTP methods it actually supports (e.g. GET + REPORT on /eval and /sdk/evalx, GET on goals).

Route registration now shares the same method list between mux routing and CORS AllowedMethods, fixing preflight failures when browsers request non-GET methods like REPORT. Adds cors_test.go to assert OPTIONS preflight allows configured methods and rejects others.

^{Reviewed by Cursor Bugbot for commit 0f8f39d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.