Send Access-Control-Max-Age header

This issue has been migrated from [#9669](https://github.com/matrix-org/synapse/issues/9669).

---

**Description:**

If synapse sent an Access-Control-Max-Age header with its CORS responses, user agents could cache the CORS response and wouldn't need to do an OPTIONS request for every single /sync request. Even caching for 60s could massively reduce the number of requests on a busy account, but it would probably make sense for it to be a config option.

Context: all C/S API requests need to be preflighted if they send the access token using the `Authorization` header (even GET requests) because `Authorization` is not in the standard set of allowed headers.

Start by locating Synapse's CORS response handling for client-server API requests, then trace the /sync path and its OPTIONS preflight behavior. Define how Access-Control-Max-Age should be applied, including whether its value is configurable, and verify that browsers can cache the response without changing authorization behavior.

Written by the indexing model from the issue text.