fix: add X-LaunchDarkly-Instance-Id to browser CORS allowlist

[keelerm84]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Port of #734 (v8) to v9.

Describe the solution you've provided

Adds X-LaunchDarkly-Instance-Id to browser.DefaultAllowedHeaders — the Access-Control-Allow-Headers value for the browser JS subrouter.

This keeps Relay consistent with what underlying backend systems now advertise and avoids dropped browser preflights if a browser JS SDK begins sending the header.

Describe alternatives you've considered

N/A — identical change to #734.

Additional context

Existing CORS tests reference DefaultAllowedHeaders symbolically, so they cover the new value automatically.

Link to Devin session: https://app.devin.ai/sessions/57c97daf9ab24e6fae8fa5ff01c2267a
Requested by: @keelerm84

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring