feat(core): add additive CORS configuration fields

[strantalis]

Proposed Changes

Add additionalheaders, additionalmethods, and additionalexposedheaders
fields to CORS config, allowing operators to append custom values without
replacing the entire default list.

• Add mergeStringSlices() for case-sensitive method deduplication
• Add mergeHeaderSlices() for case-insensitive header deduplication (RFC 7230)
• Add Effective*() methods to compute merged values at runtime
• Log effective CORS values at startup for operator visibility
• Add unit tests for merge functions and Effective* methods
• Update docs/Configuring.md with CORS configuration section

Operators can now add custom headers without copying all defaults:

server:
  cors: 
    additionalheaders: 
      - X-Custom-Header

Backwards compatible: existing configs work unchanged.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[strantalis]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a valuable feature by adding additive CORS configuration fields, allowing operators to extend default lists without replacing them. The implementation is robust, including correct handling of case-insensitive headers, comprehensive unit and integration tests, and clear documentation. I have one suggestion to refactor the slice merging logic to reduce code duplication, which would enhance maintainability. Overall, this is a well-executed and beneficial change.