Fix CORS credentials on app-dev reverse-proxy preflight

[trippyogi]

WHY are these changes introduced?

Fixes #8259

After #7164, the app-dev reverse proxy began answering CORS OPTIONS itself instead of forwarding them to the backend. That synthetic 204 included Access-Control-Allow-Origin / methods / headers, but not Access-Control-Allow-Credentials. Credentialed cross-origin requests that require preflight therefore fail before reaching the backend.

WHAT is this pull request doing?

When the preflight request has an Origin, include Access-Control-Allow-Credentials: true on the proxy's OPTIONS response (still reflecting the concrete origin, never pairing credentials with *).

• Unit coverage for Origin + credentials and no-Origin (credentials absent)
• Patch changeset for @shopify/app

How to test your changes?

pnpm --filter @shopify/app exec vitest run src/cli/utilities/app/http-reverse-proxy.test.ts

Expect 12/12. The OPTIONS cases assert:

• with Origin → Access-Control-Allow-Credentials: true
• without Origin → credentials header absent

Optional manual check: run shopify app dev with a frontend request that actually triggers preflight (e.g. POST + Content-Type: application/json + credentials: include). On main the OPTIONS preflight fails CORS; on this branch it succeeds (backend must still send credentials CORS on the actual response).

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add