Stability checkpoint — CORS W3C trace context headers (MR !199)

Pipeline #824 green on main commit e14285d.
Includes : SB3 wave 8 (KafkaConfig V2 overlay) + CORS allowlist now
includes traceparent / tracestate / baggage so the UI's OTel Web SDK
auto-instrumented XHR is no longer rejected at preflight.

Regression test : SecurityConfigTest.corsConfigurationSource_includesW3CTraceContextHeaders.

See: https://gitlab.com/mirador1/mirador-service/-/pipelines/2479221932