Allow Figma authentication header in REST CORS

[DavidBabinec]

What changed

• allow X-Core-Framework-Key in WordPress REST CORS preflight responses
• run WordPress E2E with supported pretty permalinks
• add an E2E request matching Figma's Origin: null preflight exactly
• assert both the null origin and custom authentication header are allowed

Root cause

The Figma key parsed correctly and the browser reached the WordPress REST endpoint, but preflight stopped the request because WordPress's default Access-Control-Allow-Headers list did not include X-Core-Framework-Key. WordPress already allowed Figma's null origin. This change adds only the missing request header to the REST CORS allowlist; authentication remains enforced by the connection key.

Validation

• live endpoint preflight reproduced the missing header
• PHP syntax check
• PHPUnit: 21 tests, 23 assertions
• WordPress E2E on WordPress 7.0.4 / PHP 8.2.33
• E2E asserts Access-Control-Allow-Origin: null
• E2E asserts Access-Control-Allow-Headers includes X-Core-Framework-Key