Lint CORS response headers to ensure browser/agent x402 clients can send PAYMENT-SIGNATURE and read PAYMENT-REQUIRED / PAYMENT-RESPONSE.