fix(cors): lowercase cors headers for rack 3 compatibility

[jimehk]

Modify CORS headers to use lowercase keys for Rack 3.x compatibility.

In non-production environments Rack 3 throws lint errors instead of
rendering pages if any of the headers are capitalized. This is to
conform with the HTTP/2 specification.

[Copilot]

Pull Request Overview

This PR modifies CORS header keys to use lowercase format for Rack 3.x compatibility, conforming to the HTTP/2 specification which requires lowercase header names.

Key Changes:

• Updated CORS header keys from PascalCase to lowercase in the core CORS module
• Updated all test assertions to expect lowercase CORS header keys

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
lib/apia/cors.rb	Updated CORS header keys from PascalCase (e.g., 'Access-Control-Allow-Origin') to lowercase (e.g., 'access-control-allow-origin')
spec/specs/apia/cors_spec.rb	Updated test expectations and descriptions to use lowercase CORS header keys
spec/specs/apia/endpoint_spec.rb	Updated test assertions to expect lowercase CORS header keys in response headers
spec/specs/apia/rack_spec.rb	Updated test assertions to expect lowercase CORS header keys in Rack response headers

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}