Fixed CORS requests failing with forward auth via proxy provider

[solidDoWant]

Details

This allows CORS requests to go through the proxy provider forward auth "plan" (not sure if this is the right word), fixing XHR and fetch requests, as well as WebSockets when the forward auth plan needs to be ran again.

I'm not really familiar with this codebase and I don't do much front end web dev, so there may be issues (including security vulnerabilities) introduced by this. Please review this carefully and assume that I don't know what I'm doing.

I've tested this patch against a branch based off of the latest release, and I have it working with Radarr, an app that uses credentialed XMLHTTPRequests and SignalR over WebSockets. It's working great, and renewing the proxy cookie is 100% transparent to me as a user. Note that I have only tested with Envoy/Istio. I don't have (or plan on having) traefik, caddy, or nginx deployed as a reverse proxy, so I'll be unable to test the changes that are specific to these reverse proxies.

One new requirement of this is that front-end application requests must set XMLHTTPRequest.withCredentials = true. Without this, the browser won't send the authentik session cookie to the authentik callback endpoint, making authentik think that every request needs to go through the application's configured auth flow. This needs to be set even if the application otherwise does not use credentials for these requests. I don't think that there is a way around this with how forward auth is handled with the proxy cookie. I'm not sure where to document this.

Closes #10057

---

Checklist

• Local tests pass (ak test authentik/) - These take like an hour to run locally. If they're not ran automatically in CI then I'll run them overnight.
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated - Please see above note about application needing XMLHTTPRequest.withCredentials = true
• The documentation has been formatted (make docs)

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	c80d5a6
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/68e039f30a4fdd0008d1a53a
😎 Deploy Preview	https://deploy-preview-17233--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	c80d5a6
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/68e039f3df5dcd0007c5752b
😎 Deploy Preview	https://deploy-preview-17233--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	c80d5a6
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/68e039f3106adf0008d07268

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.57%. Comparing base (9e4b609) to head (c10de2e).
⚠️ Report is 27 commits behind head on main.

Files with missing lines	Patch %	Lines
authentik/providers/oauth2/views/authorize.py	72.72%	3 Missing ⚠️
authentik/policies/views.py	87.50%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #17233      +/-   ##
==========================================
- Coverage   92.90%   92.57%   -0.33%     
==========================================
  Files         853      856       +3     
  Lines       46310    46498     +188     
==========================================
+ Hits        43025    43047      +22     
- Misses       3285     3451     +166     

Flag	Coverage Δ
e2e	44.90% <78.94%> (-1.22%)	⬇️
integration	23.11% <0.00%> (-0.10%)	⬇️
unit	91.01% <78.94%> (-0.01%)	⬇️
unit-migrate	91.07% <78.94%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[solidDoWant]

I'm aware code coverage is lacking. I'll add tests when/if this gets a first pass review. Running tests in this project locally is pretty difficult and time consuming, so I don't really want to put in this work if the actual code change needs a major rework.