fix(cors): add X-Widget-Key to vercel.json /api/* Allow-Headers (#2316)

vercel.json header injection for /api/(.*) was overriding the
Access-Control-Allow-Headers returned by individual edge functions,
so api/widget-agent OPTIONS preflights never included X-Widget-Key
regardless of what the function itself returned.

vercel.json

@@ -15,7 +15,7 @@
       "headers": [
         { "key": "Access-Control-Allow-Origin", "value": "*" },
         { "key": "Access-Control-Allow-Methods", "value": "GET, POST, OPTIONS" },
-        { "key": "Access-Control-Allow-Headers", "value": "Content-Type, Authorization, X-WorldMonitor-Key" }
+        { "key": "Access-Control-Allow-Headers", "value": "Content-Type, Authorization, X-WorldMonitor-Key, X-Widget-Key, X-Pro-Key" }
       ]
     },
     {