While the request span is recording, TelemetryMiddleware adds
`traceresponse: 00-<trace>-<span>-<flags>` and
`Server-Timing: traceparent;desc="..."` to http.response.start, and appends
`traceresponse` to an existing Access-Control-Expose-Headers (never
overwriting it, never adding one when CORS is off, leaving `*` alone).
Hand-rolled because TraceResponsePropagator lives in
opentelemetry-instrumentation, not the API. No Timing-Allow-Origin, no new
setting.
test_cors now expects "Link, traceresponse", since the test suite always has
a recording provider installed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
