Make OrcaBusApiGateway CORS config extensible

Problem

OrcaBusApiGateway currently hardcodes CORS allowHeaders and allowMethods, and does not expose response headers through CORS.

Service APIs may need additional CORS support, for example:

• PUT methods, such as replacing a resource representation with PUT /api/v1/...
• custom request headers, such as If-Match for optimistic concurrency
• exposed response headers, such as ETag, so browser clients can read version/concurrency metadata

Because browser preflight is handled by API Gateway before Lambda receives the request, missing gateway CORS methods or headers cannot be fixed by service-level CORS middleware.

Proposed Change

Update OrcaBusApiGateway to:

• include PUT in default allowMethods
• allow services to extend allowHeaders
• allow services to configure exposeHeaders