Expose X-Streaming-Format header for api requests

What does this MR do and why?

Exposes the X-Streaming-Format response header in GitLab's CORS configuration.

When the WebIDE (running cross-origin) makes requests to the GitLab API, the browser's CORS policy blocks access to response headers that are not explicitly exposed by the server. The X-Streaming-Format header was missing from the headers_to_expose list in config/application.rb, causing response.headers.get('X-Streaming-Format') to always return null in the language server. This meant SSE responses were never parsed correctly, resulting in raw SSE event data being displayed instead of code suggestions.

References

• gitlab-org/editor-extensions/gitlab-lsp#2245 (closed) - WebIDE displays raw SSE data instead of code suggestions during streaming
• Related: #592825 - Incorrect code suggestion when working in WebIDE

Screenshots or screen recordings

Showing web ide code suggestions working for local gdk when the header is exposed

How to set up and validate locally

Please note this is assuming you already have duo setup locally for your gdk

1. Clone this branch on your local gdk
2. Open the WebIDE on any gdk project
3. Create a .py file
4. Add a comment like # Write a function to add two numbers
5. Trigger code generation
6. Confirm that rendered code suggestions appear instead of raw SSE event data

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #2245 (closed)