CORS error during access token reconciliation with xhr/ajax call from web browser when access token is expired

*Description*:
Hi team
I have an issue with OIDC and the refresh token. Every time the access token expired or removed by logout path, we need to do hard refresh to obtain the new access token. Is it the expected behaviour? If we don't do hard refresh, interacting with any link in the pages (where the api is part of the same backend) does not trigger the access token refresh because the call is block due to the CORS.
I want behind the scene the access token is refreshed without the need to do hard refresh so the user experience is seamless.

*Repro steps*:
- setup oidc with security policy (google oauth2)
- enable refresh token
- once logged in with oidc, wait until the access token expired or force clear the access token by calling `/logout` endpoint
- don't do hard refresh but instead call some link that call the same backend api resources
- error will occur

*Environment*:
- gateway version v1.4.3

*Sanitized Logs*:
```
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:394] [Tags: "ConnectionId":"340769"] new stream
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1196] [Tags: "ConnectionId":"340769","StreamId":"8563927300280577162"] request headers complete (end_stream=true):
envoy ':method', 'GET'
envoy ':authority', 'web.testhost.com'
envoy ':scheme', 'https'
envoy ':path', '/api/catalog/v1beta1/types'
envoy 'sec-ch-ua-platform', '"macOS"'
envoy 'user-agent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
envoy 'accept', 'application/json, text/plain, */*'
envoy 'sec-ch-ua', '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"'
envoy 'sec-ch-ua-mobile', '?0'
envoy 'sec-fetch-site', 'same-origin'
envoy 'sec-fetch-mode', 'cors'
envoy 'sec-fetch-dest', 'empty'
envoy 'referer', 'https://web.testhost.com/'
envoy 'accept-encoding', 'gzip, deflate, br, zstd'
envoy 'accept-language', 'en-US,en;q=0.9'
envoy 'priority', 'u=1, i'
envoy 'cookie', '_ga=xxxx; OauthExpires-x1234=xxxxx; OauthNonce-x1234=xxxxx.xxxxx; CodeVerifier=xxxxxxxxxxxxxxxxxx-xxxxxx-xxxxxx; _ga_xxxxxx=xxxxxx'
envoy
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1179] [Tags: "ConnectionId":"340769","StreamId":"8563927300280577162"] request end stream timestamp recorded
envoy [2025-08-18 04:09:49.939][16][debug][connection] [./source/common/network/connection_impl.h:99] [Tags: "ConnectionId":"340769"] current connecting state: false
envoy [2025-08-18 04:09:49.939][16][debug][jwt] [source/extensions/filters/http/jwt_authn/filter.cc:168] Called Filter : setDecoderFilterCallbacks
envoy [2025-08-18 04:09:49.939][16][debug][oauth2] [source/extensions/filters/http/oauth2/filter.cc:728] can not skip oauth flow
envoy [2025-08-18 04:09:49.939][16][debug][oauth2] [source/extensions/filters/http/oauth2/filter.cc:655] redirecting to OAuth server
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1906] [Tags: "ConnectionId":"340769","StreamId":"8563927300280577162"] encoding headers via codec (end_stream=true):
envoy ':status', '302'
envoy 'set-cookie', 'CodeVerifier=xxxxxxx;path=/;Max-Age=600;secure;HttpOnly'
envoy 'location', 'https://accounts.google.com/o/oauth2/v2/auth?client_id=xxxx-xxxx.apps.googleusercontent.com&code_challenge=xxxxxx&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fweb.testhost.com%2Foauth2%2Fcallback&response_type=code&scope=openid%20email&state=xxx'
envoy 'date', 'Mon, 18 Aug 2025 04:09:49 GMT'
envoy
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:394] [Tags: "ConnectionId":"340769"] new stream
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1196] [Tags: "ConnectionId":"340769","StreamId":"17671342627379533624"] request headers complete (end_stream=true):
envoy ':method', 'GET'
envoy ':authority', 'web.testhost.com'
envoy ':scheme', 'https'
envoy ':path', '/api/catalog/v1beta1/me/starred?size=5'
envoy 'sec-ch-ua-platform', '"macOS"'
envoy 'user-agent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
envoy 'accept', 'application/json, text/plain, */*'
envoy 'sec-ch-ua', '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"'
envoy 'sec-ch-ua-mobile', '?0'
envoy 'sec-fetch-site', 'same-origin'
envoy 'sec-fetch-mode', 'cors'
envoy 'sec-fetch-dest', 'empty'
envoy 'referer', 'https://web.testhost.com/'
envoy 'accept-encoding', 'gzip, deflate, br, zstd'
envoy 'accept-language', 'en-US,en;q=0.9'
envoy 'priority', 'u=1, i'
envoy 'cookie', '_ga=xxxx; OauthExpires-x1234=xxxxx; OauthNonce-x1234=xxxxx.xxxxx; CodeVerifier=xxxxxxxxxxxxxxxxxx-xxxxxx-xxxxxx; _ga_xxxxxx=xxxxxx'
envoy
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1179] [Tags: "ConnectionId":"340769","StreamId":"17671342627379533624"] request end stream timestamp recorded
envoy [2025-08-18 04:09:49.939][16][debug][connection] [./source/common/network/connection_impl.h:99] [Tags: "ConnectionId":"340769"] current connecting state: false
envoy [2025-08-18 04:09:49.939][16][debug][jwt] [source/extensions/filters/http/jwt_authn/filter.cc:168] Called Filter : setDecoderFilterCallbacks
envoy [2025-08-18 04:09:49.939][16][debug][oauth2] [source/extensions/filters/http/oauth2/filter.cc:728] can not skip oauth flow
envoy [2025-08-18 04:09:49.939][16][debug][oauth2] [source/extensions/filters/http/oauth2/filter.cc:655] redirecting to OAuth server
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:1906] [Tags: "ConnectionId":"340769","StreamId":"17671342627379533624"] encoding headers via codec (end_stream=true):
envoy ':status', '302'
envoy 'set-cookie', 'CodeVerifier=xxxxx-3kT0VgVwVuHv9rUi4AWgWawVhbBF6RfrnOFrWFBjjPlkufMuQwXtfQxP32xT8Eck4bu-thmiC_w;path=/;Max-Age=600;secure;HttpOnly'
envoy 'location', 'https://accounts.google.com/o/oauth2/v2/auth?client_id=xxxx-xxxx.apps.googleusercontent.com&code_challenge=xxxxxx&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fweb.testhost.com%2Foauth2%2Fcallback&response_type=code&scope=openid%20email&state=xxxxxxaaa'
envoy 'date', 'Mon, 18 Aug 2025 04:09:49 GMT'
envoy
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:2021] [Tags: "ConnectionId":"340769","StreamId":"8563927300280577162"] Codec completed encoding stream.
envoy [2025-08-18 04:09:49.939][16][debug][jwt] [source/extensions/filters/http/jwt_authn/filter.cc:46] Called Filter : onDestroy
envoy [2025-08-18 04:09:49.939][16][debug][http2] [source/common/http/http2/codec_impl.cc:1386] [Tags: "ConnectionId":"340769"] stream 15 closed: 0
envoy [2025-08-18 04:09:49.939][16][debug][http2] [source/common/http/http2/codec_impl.cc:1449] [Tags: "ConnectionId":"340769"] Recouping 0 bytes of flow control window for stream 15.
envoy [2025-08-18 04:09:49.939][16][debug][http] [source/common/http/conn_manager_impl.cc:2021] [Tags: "ConnectionId":"340769","StreamId":"17671342627379533624"] Codec completed encoding stream.
envoy [2025-08-18 04:09:49.939][16][debug][jwt] [source/extensions/filters/http/jwt_authn/filter.cc:46] Called Filter : onDestroy
envoy [2025-08-18 04:09:49.939][16][debug][http2] [source/common/http/http2/codec_impl.cc:1386] [Tags: "ConnectionId":"340769"] stream 17 closed: 0
```