Add opt-in CORS configuration to the Python server

[forman]

Summary

Adds opt-in Cross-Origin Resource Sharing (CORS) support to the Python RemoteState server.

Closes #49

serve() now accepts cors_origins, allowing deployments to explicitly permit browser HTTP requests from trusted frontend origins. CORS remains disabled by default.

The CORS configuration:

• permits configured origins only
• supports browser preflight requests
• permits all HTTP methods and request headers, including OAuth bearer-token Authorization headers
• does not enable credentialed requests

Usage

rs.serve(
    service,
    cors_origins=["https://app.example.com"],
)

For intentionally public, token-authenticated APIs:

rs.serve(service, cors_origins=["*"])

Testing

• Allowed-origin response headers
• CORS preflight handling
• Rejection of unconfigured origins
• Secure default with CORS disabled
• Python lint and type checks

[TejasMorbagal]

LGTM