Make CORS work for oauth2 handlers (#28184)

[GiteaBot]

Backport #28184 by @wxiaoguang

Fix #25473

Although there was m.Post("/#/oauth/access_token", CorsHandler() ... ,it never really worked, because it still lacks the "OPTIONS" handler.

After the fix:

$ curl -v -X OPTIONS --header "Access-Control-Request-Method: POST" http://localhost:3000/#/oauth/access_token
*   Trying 127.0.0.1:3000...
> OPTIONS /#/oauth/access_token HTTP/1.1
> Accept: */*
> Access-Control-Request-Method: POST
>
< HTTP/1.1 200 OK
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< X-Frame-Options: SAMEORIGIN
< X-Gitea-Debug: RUN_MODE=dev
< Date: Thu, 23 Nov 2023 11:45:36 GMT
< Content-Length: 0



$ curl -v -X OPTIONS http://localhost:3000/#/oauth/access_token
> OPTIONS /#/oauth/access_token HTTP/1.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Vary: Origin
< X-Frame-Options: SAMEORIGIN
< X-Gitea-Debug: RUN_MODE=dev
< Date: Thu, 23 Nov 2023 11:45:32 GMT
< Content-Length: 0

ps: I haven't fully tested the "oauth2 cors client", we can make further fixes if there are still problems.