[Server] Make StreamableHttpTransport more configurable, e.g. for CORS headers

[chr-hertel]

Currently the StreamableHttpTransport is explicit about the HTTP headers (e.g. for CORS) and lacks flexibility for configuring that behavior.

Would it be possible to leave security features to the actual HTTP Proxy server that's running PHP (ie ngin/php/symfony)? Indeed this is hiding security settings and we've no ways of changing it.

Originally posted by @soyuka in #110 (comment)

[CodeWithKyrian]

Closed by #118