docs(cors): note reverse-proxy header duplication on CORS godoc

Clarify that CORS headers are written before the handler runs, so chained
proxies that copy upstream CORS headers should dedupe at the proxy
(ReverseProxy.ModifyResponse) rather than expect this middleware to remove
duplicates. Refs #2853.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: vishr

middleware/cors.go

@@ -125,6 +125,12 @@ type CORSConfig struct {
 // misconfigurations for Bitcoins and bounties] and [Portswigger: Cross-origin
 // resource sharing (CORS)] for more details.
 //
+// CORS headers are written before the handler runs. Do not enable CORS on
+// internal upstream layers; let the edge own it. If you place this in front of a
+// reverse proxy that copies upstream CORS headers, dedupe at the proxy (e.g.
+// httputil.ReverseProxy.ModifyResponse) rather than expecting this middleware to
+// remove the duplicates.
+//
 // [MDN: Cross-Origin Resource Sharing (CORS)]: https://developer.mozilla.org/en/docs/Web/HTTP/Access_control_CORS
 // [Exploiting CORS misconfigurations for Bitcoins and bounties]: https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
 // [Portswigger: Cross-origin resource sharing (CORS)]: https://portswigger.net/web-security/cors