OAuth authorize and revoke responses omit CORS headers

## What

OAuth endpoints used from a browser SPA omit CORS headers (/authorize and /revoke). Also: missing Access-Control-Allow-Origin on API/OAuth calls from a browser. Confirm it is the same allow-origin config before closing.

## Want

- OAuth endpoints used from a browser SPA omit CORS headers (/authorize
- Related missing Access-Control-Allow-Origin on API/OAuth calls from a browser
- Confirm it is the same allow-origin config before closing

## Ideas this came from

- [#10057 application/o/authorize endpoint missing CORS headers](https://github.com/goauthentik/authentik/issues/10057) — Not sure it is a bug or a misconfiguration somewhere... Web application is calling the /application/o/authorize/ endpoint from the browser. It is failing with t
- [#11057 `/revoke` end point missing CORS header](https://github.com/goauthentik/authentik/issues/11057) — After reading the source code, I've discovered the implementation for token revocation was followed by the RFC 7009: https://datatracker.ietf.org/doc/html/rfc70
- [#12159 Missing CORS header: Cannot perform an API request - can I configure allowed origins?](https://github.com/goauthentik/authentik/issues/12159) — When trying to fetch data from the authentik-API i run into an error: Cross-source (cross-origin) request blocked: The same-source rule prohibits reading the ex

Start by tracing the /authorize and /revoke OAuth endpoints and the related API/OAuth request path to find where CORS headers and the allow-origin configuration are handled. Compare the configuration across these paths and review the linked issues for context. Done means the shared allow-origin behavior is confirmed and the affected browser requests have the expected Access-Control-Allow-Origin header.

Written by the indexing model from the issue text.