CorsAllowAllMiddleware: invalid CORS headers and missing preflight handling #24

Summary

CorsAllowAllMiddleware sets CORS headers that are invalid per the Fetch CORS protocol and does not handle OPTIONS preflight correctly.

Problems

1. Invalid header combination
   Sets both Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true.
   This is forbidden by the CORS/Fetch spec; browsers reject credentialed cross-origin responses.
   Ref: https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
2. No preflight short-circuit
   Always calls $handler->handle($request) first. An OPTIONS preflight without a matching route typically returns 405, so preflight fails.
3. Incorrect Allow: *
Allow is not a CORS header; Allow: * is non-standard here.

Expected

• Never combine * origin with credentials.
• Answer preflight (OPTIONS + Access-Control-Request-Method) with 204 from the middleware, without routing.
• Remove Allow: *.

Environment

• Package: yiisoft/http-middleware
• Class: Yiisoft\HttpMiddleware\CorsAllowAllMiddleware