GeezerVison

Continues #15669

This PR introduces a partial fix for #15096; it allows operators to specify the CORS behavior on a per-coder_app level.

This change requires cors_behavior to be set on a given coder_app; coder/terraform-provider-coder#309 introduces that new attribute.

coderd currently handles CORS automatically by handling preflight requests and stripping CORS headers from upstream coder_app responses.

Two CORS behaviors are defined in this PR:

• simple: the current behavior of handling CORS within coderd
• passthru: new behavior which transparently bypasses our CORS handling in coderd so the coder_app service is then fully responsible for handling CORS

We plan to further add this behavior to port shares.

The sharing level (owner, authenticated, public) is still respected, regardless of CORS behavior.