feat: replicate per-bucket CORS across sites and harden the protocol path

Site replication emitted SRBucketMetaTypeCorsConfig on PutBucketCors, but
the peer receive/apply, initial-sync, status, and heal paths did not carry
the CORS metadata. Replicated sites could therefore diverge on CORS config
even though the originating request succeeded.

Complete every site-replication path for CORS, mirroring the SSEConfig
pattern:
  - peer apply: PeerBucketCorsConfigHandler + item.Cors handling in
    PeerBucketMetadataUpdateHandler, with an updatedAt staleness guard
  - initial sync: push existing CorsConfigXML via BucketMetaHook
  - status: parse per-site CorsConfig, count/compare, surface
    CorsCfgMismatch/HasCorsCfgSet/ReplicatedCorsConfig, and include CORS in
    the bucket-stats aggregation filter
  - heal: healCORSMetadata, including nil -> delete propagation

Also harden the request/config path:
  - PutBucketCors validates the supplied Content-MD5/checksum via
    validateLengthAndChecksum
  - CORS validation rejects more than one wildcard per AllowedOrigin/
    AllowedHeader and enforces the 255-char rule ID limit
  - preflight responses Vary on Origin, Access-Control-Request-Method, and
    Access-Control-Request-Headers

Add focused tests for the CORS SR transport round-trip, the metadata
equality helper, and the new validation constraints.

Signed-off-by: h5vx <h5v@protonmail.com>

buildscripts/rebrand-guard/compat-baseline.json

@@ -4037,6 +4037,7 @@
     "cmd:cmd:method:SiteReplicationSys.Netperf",
     "cmd:cmd:method:SiteReplicationSys.PeerAddPolicyHandler",
     "cmd:cmd:method:SiteReplicationSys.PeerBucketConfigureReplHandler",
+    "cmd:cmd:method:SiteReplicationSys.PeerBucketCorsConfigHandler",
     "cmd:cmd:method:SiteReplicationSys.PeerBucketDeleteHandler",
     "cmd:cmd:method:SiteReplicationSys.PeerBucketLCConfigHandler",
     "cmd:cmd:method:SiteReplicationSys.PeerBucketMakeWithVersioningHandler",