feat: Add CORS configuration for browser-based MCP clients

[jerome3o-anthropic]

Summary

• Add CORS middleware to streamable HTTP example servers
• Configure minimal CORS settings to expose Mcp-Session-Id header
• Add documentation for CORS configuration in the README

Problem

Browser-based MCP clients cannot access the Mcp-Session-Id header from initialization responses due to CORS restrictions. Without this header, they cannot establish sessions with MCP servers.

Solution

This PR adds Starlette's CORSMiddleware to the example servers and configures it to expose the Mcp-Session-Id header via expose_headers. The configuration is minimal, only allowing the HTTP methods required by the MCP protocol (GET, POST, DELETE).

Changes

• Add CORSMiddleware import and configuration to:
  • examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
  • examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
• Add CORS configuration section to README under "Streamable HTTP Transport"

Test plan

• Example servers start successfully with CORS configured
• Browser-based clients can read the Mcp-Session-Id header from responses
• CORS headers are properly set on responses
• Only GET, POST, and DELETE methods are allowed

Reported-by: Jerome