Access-Control-Allow-Methods not always set correctly

[frenchy64]

Due to some quirks of HeaderMap, if Access-Control-Allow-Methods is already present in a request, in some cases the the CORS headers are not correctly set.

See test cases in this branch and proposed fix: https://github.com/frenchy64/ring-cors/pull/1/files

[ejschoen]

I just ran into this--after upgrading a large app to ring 1.11.0. When the response contains a clj-http.headers/HeaderMap, the Access-Control-Allow-Methods header gets returned from the CORs middleware as e.g., #{:get :post} rather then "GET< POST", and the ring-jetty-adapter's ring.util.jakarta.servlet/set-headers code can't handle it, and throws a ClassCastException.