This PR does the following

Addresses CORS preflight handling in HtmlUnit by correcting the isPreflightAuthorized method in XMLHttpRequest to properly recognize the wildcard * value for the Access-Control-Allow-Headers response header.

Problem

When a server responds to a CORS preflight request with Access-Control-Allow-Headers: *, HtmlUnit does not recognize this as a wildcard. Instead, it treats * as a literal header name and adds it to the set of allowed header names. This causes the preflight authorization check to fail for any non-simple headers, even though the server intended to allow all of them.