feat: replicate per-bucket CORS across sites and harden the protocol path

Site replication emitted SRBucketMetaTypeCorsConfig on PutBucketCors, but
the peer receive/apply, initial-sync, status, and heal paths did not carry
the CORS metadata. Replicated sites could therefore diverge on CORS config
even though the originating request succeeded.

Complete every site-replication path for CORS, mirroring the SSEConfig
pattern:
  - peer apply: PeerBucketCorsConfigHandler + item.Cors handling in
    PeerBucketMetadataUpdateHandler, with an updatedAt staleness guard
  - initial sync: push existing CorsConfigXML via BucketMetaHook
  - status: parse per-site CorsConfig, count/compare, surface
    CorsCfgMismatch/HasCorsCfgSet/ReplicatedCorsConfig, and include CORS in
    the bucket-stats aggregation filter
  - heal: healCORSMetadata, including nil -> delete propagation

Also harden the request/config path:
  - PutBucketCors validates the supplied Content-MD5/checksum via
    validateLengthAndChecksum
  - CORS validation rejects more than one wildcard per AllowedOrigin/
    AllowedHeader and enforces the 255-char rule ID limit
  - preflight responses Vary on Origin, Access-Control-Request-Method, and
    Access-Control-Request-Headers

Add focused tests for the CORS SR transport round-trip, the metadata
equality helper, and the new validation constraints.

Signed-off-by: h5vx <h5v@protonmail.com>

cmd/site-replication_test.go

@@ -18,7 +18,10 @@
 package cmd
 
 import (
+	"encoding/base64"
+	"encoding/json"
 	"testing"
+	"time"
 
 	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7/pkg/set"
@@ -66,3 +69,92 @@ func TestGetMissingSiteNames(t *testing.T) {
 		}
 	}
 }
+
+// TestSRBucketMetaCorsRoundTrip verifies that a CORS bucket-meta item
+// survives the JSON transport used by SRPeerReplicateBucketItem and that
+// the base64-encoded payload decodes back to the original XML bytes. This
+// mirrors the initial-sync push, the peer-apply path, and the heal path,
+// all of which carry the config through SRBucketMeta.Cors as base64.
+func TestSRBucketMetaCorsRoundTrip(t *testing.T) {
+	const corsXML = `<CORSConfiguration><CORSRule><AllowedOrigin>https://app.example.com</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`
+	b64 := base64.StdEncoding.EncodeToString([]byte(corsXML))
+	updatedAt := time.Now().UTC().Truncate(time.Second)
+
+	item := madmin.SRBucketMeta{
+		Type:      madmin.SRBucketMetaTypeCorsConfig,
+		Bucket:    "testbucket",
+		Cors:      &b64,
+		UpdatedAt: updatedAt,
+	}
+
+	data, err := json.Marshal(item)
+	if err != nil {
+		t.Fatalf("marshal failed: %v", err)
+	}
+
+	var got madmin.SRBucketMeta
+	if err := json.Unmarshal(data, &got); err != nil {
+		t.Fatalf("unmarshal failed: %v", err)
+	}
+
+	if got.Type != madmin.SRBucketMetaTypeCorsConfig {
+		t.Fatalf("type mismatch: got %q", got.Type)
+	}
+	if got.Cors == nil {
+		t.Fatal("expected non-nil Cors after round-trip")
+	}
+	decoded, err := base64.StdEncoding.DecodeString(*got.Cors)
+	if err != nil {
+		t.Fatalf("decode failed: %v", err)
+	}
+	if string(decoded) != corsXML {
+		t.Fatalf("payload mismatch:\n got %q\nwant %q", decoded, corsXML)
+	}
+	if !got.UpdatedAt.Equal(updatedAt) {
+		t.Fatalf("UpdatedAt mismatch: got %v want %v", got.UpdatedAt, updatedAt)
+	}
+
+	// A deletion is signaled with a nil Cors pointer; it must survive too.
+	del := madmin.SRBucketMeta{
+		Type:      madmin.SRBucketMetaTypeCorsConfig,
+		Bucket:    "testbucket",
+		Cors:      nil,
+		UpdatedAt: updatedAt,
+	}
+	data, err = json.Marshal(del)
+	if err != nil {
+		t.Fatalf("marshal (delete) failed: %v", err)
+	}
+	var gotDel madmin.SRBucketMeta
+	if err := json.Unmarshal(data, &gotDel); err != nil {
+		t.Fatalf("unmarshal (delete) failed: %v", err)
+	}
+	if gotDel.Cors != nil {
+		t.Fatalf("expected nil Cors for deletion, got %q", *gotDel.Cors)
+	}
+}
+
+// TestIsBucketMetadataEqualCors covers the pointer-comparison helper used by
+// the CORS heal path to decide whether a peer already holds the latest config.
+func TestIsBucketMetadataEqualCors(t *testing.T) {
+	a := base64.StdEncoding.EncodeToString([]byte("config-a"))
+	b := base64.StdEncoding.EncodeToString([]byte("config-b"))
+
+	cases := []struct {
+		name string
+		one  *string
+		two  *string
+		want bool
+	}{
+		{"both nil", nil, nil, true},
+		{"one nil", &a, nil, false},
+		{"other nil", nil, &b, false},
+		{"equal", &a, &a, true},
+		{"different", &a, &b, false},
+	}
+	for _, tc := range cases {
+		if got := isBucketMetadataEqual(tc.one, tc.two); got != tc.want {
+			t.Errorf("%s: got %v want %v", tc.name, got, tc.want)
+		}
+	}
+}