Supabase Edge Functions truncate headers, breaking CORS for custom headers

- [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug Supabase Edge Functions are truncating custom headers in `Access-Control-Allow-Headers` during OPTIONS preflight responses. Although the Edge Function code explicitly returns all allowed headers in the Access-Control-Allow-Headers response, Supabase’s infrastructure truncates this header list during the OPTIONS preflight request and only returns the first four standard headers. As a result, the browser blocks the actual request with a CORS error before it ever reaches the Edge Function. **Expected headers in preflight:** ``` authorization, x-client-info, apikey, content-type, x-session-id, x-user-id, x-trace-id, x-span-id ``` **Actual headers returned:** ``` authorization, x-client-info, apikey, content-type ``` This makes it impossible to use custom headers for user tracking, distributed tracing, or session management in Edge Functions. ## To Reproduce ### 1. Create shared CORS headers module Create `supabase/functions/_shared/cors.ts`: ```typescript export const corsHeaders = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS", "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type, x-session-id, x-user-id, x-trace-id, x-span-id", "Access-Control-Expose-Headers": "x-user-id, x-session-id, x-trace-id", "Access-Control-Allow-Credentials": "true" }; ``` ### 2. Create Edge Function using CORS headers Create `supabase/functions/client-log/index.ts`: ```typescript import { serve } from "https://deno.land/std@0.190.0/http/server.ts"; import { corsHeaders } from "../_shared/cors.ts"; serve(async (req) => { // Handle OPTIONS preflight if (req.method === 'OPTIONS') { return new Response…