Add configuration for CORS allowed headers (#21747)

This PR enhances the CORS middleware usage by allowing for the headers
to be configured in `app.ini`.

Fixes #21746

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

modules/setting/cors.go

@@ -19,10 +19,12 @@ var CORSConfig = struct {
 	Methods          []string
 	MaxAge           time.Duration
 	AllowCredentials bool
+	Headers          []string
 	XFrameOptions    string
 }{
 	Enabled:       false,
 	MaxAge:        10 * time.Minute,
+	Headers:       []string{"Content-Type", "User-Agent"},
 	XFrameOptions: "SAMEORIGIN",
 }