Loosen CORS header requirements

Bluesky started sending `x-bsky-is-beta-user` for some users on XRPC requests, but tranquil has a strict allowlist of CORS headers. The spec doesn't (?) specify any requirements around CORS headers, so we can avoid trouble when Bluesky make changes by just allowing all headers.

This PR replaces the allowlist with the request mirror behavior, where any headers sent on a CORS request are echoed back. This also matches the reference PDS.

crates/tranquil-pds/src/lib.rs

@@ -106,20 +106,7 @@ pub fn app_with_routes(state: AppState, external: ExternalRoutes) -> Router {
             CorsLayer::new()
                 .allow_origin(Any)
                 .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
-                .allow_headers(AllowHeaders::list(
-                    [
-                        http::header::AUTHORIZATION,
-                        http::header::CONTENT_TYPE,
-                        http::header::CONTENT_ENCODING,
-                        http::header::ACCEPT_ENCODING,
-                        http::header::USER_AGENT,
-                        util::HEADER_DPOP,
-                        util::HEADER_ATPROTO_PROXY,
-                        util::HEADER_ATPROTO_ACCEPT_LABELERS,
-                    ]
-                    .into_iter()
-                    .chain(util::CORS_BSKY_ALLOW_HEADERS),
-                ))
+                .allow_headers(AllowHeaders::mirror_request())
                 .expose_headers([
                     http::header::WWW_AUTHENTICATE,
                     util::HEADER_DPOP_NONCE,

crates/tranquil-pds/src/util.rs

@@ -89,10 +89,6 @@ pub const HEADER_ATPROTO_CONTENT_LABELERS: HeaderName =
     HeaderName::from_static("atproto-content-labelers");
 #[cfg(feature = "bsky-support")]
 pub const HEADER_X_BSKY_TOPICS: HeaderName = HeaderName::from_static("x-bsky-topics");
-#[cfg(feature = "bsky-support")]
-pub const CORS_BSKY_ALLOW_HEADERS: [HeaderName; 1] = [HEADER_X_BSKY_TOPICS];
-#[cfg(not(feature = "bsky-support"))]
-pub const CORS_BSKY_ALLOW_HEADERS: [HeaderName; 0] = [];
 
 pub fn get_header_str(
     headers: &HeaderMap,