Adds Access-Control-Max-Age: 600 to CORS preflight responses, telling browsers to cache the preflight for 10 minutes. Reduces redundant OPTIONS requests and improves perceived latency for browser-based API clients. Salvaged from PR #3514 by aydnOktay. Co-authored-by: aydnOktay <xaydinoktay@gmail.com>